General
-
Target
f9078e1eba2e3d6156274a282a8728e4a22933b88d24716a2bcb3fda9d820808
-
Size
818KB
-
Sample
231206-dltd3saf24
-
MD5
bc506284603d92c83f0596b98bf39535
-
SHA1
d9222dbf4e228606880866642d20e46b447831d0
-
SHA256
f9078e1eba2e3d6156274a282a8728e4a22933b88d24716a2bcb3fda9d820808
-
SHA512
240c771c76c19e108d4ce9b346bc7221d3ee54d97d3ca115f78f8b0fdfe888bad2e533befc46cd4b388d1d1f9187c685dfdd00da71737748e7a46ffacf06c4d3
-
SSDEEP
12288:alBKE6jD/62iNG5nF8AcnZKKZCEKKR4FDNNGK7wrlBD45H7rrbJz:aHKtD/61I+ZvMxKR4FuK7wpuxrhz
Static task
static1
Behavioral task
behavioral1
Sample
f9078e1eba2e3d6156274a282a8728e4a22933b88d24716a2bcb3fda9d820808.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
f9078e1eba2e3d6156274a282a8728e4a22933b88d24716a2bcb3fda9d820808.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
Protocol: smtp- Host:
premium162.web-hosting.com - Port:
587 - Username:
[email protected] - Password:
Success4sure2day10@
Extracted
agenttesla
Protocol: smtp- Host:
premium162.web-hosting.com - Port:
587 - Username:
[email protected] - Password:
Success4sure2day10@ - Email To:
[email protected]
Targets
-
-
Target
f9078e1eba2e3d6156274a282a8728e4a22933b88d24716a2bcb3fda9d820808
-
Size
818KB
-
MD5
bc506284603d92c83f0596b98bf39535
-
SHA1
d9222dbf4e228606880866642d20e46b447831d0
-
SHA256
f9078e1eba2e3d6156274a282a8728e4a22933b88d24716a2bcb3fda9d820808
-
SHA512
240c771c76c19e108d4ce9b346bc7221d3ee54d97d3ca115f78f8b0fdfe888bad2e533befc46cd4b388d1d1f9187c685dfdd00da71737748e7a46ffacf06c4d3
-
SSDEEP
12288:alBKE6jD/62iNG5nF8AcnZKKZCEKKR4FDNNGK7wrlBD45H7rrbJz:aHKtD/61I+ZvMxKR4FuK7wpuxrhz
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-