General
-
Target
3b4b23a27f4e658f879b3df9288b8b1a83366cbf68377fb69ac8fc68bfcaec07
-
Size
614KB
-
Sample
231207-c28chaghdn
-
MD5
22fcc96f13be9eb089424189d0f7e9dc
-
SHA1
71e3fe2f0ab536818d140b585d36252a11fd68cc
-
SHA256
3b4b23a27f4e658f879b3df9288b8b1a83366cbf68377fb69ac8fc68bfcaec07
-
SHA512
df6f3812323dea4c632a538b4c71bcb83e6484fb26c46918c31eac86168a84b7e0a5ba37a144462c3a797da3027496a166ab42874bb508fff01f0d53b9967b5c
-
SSDEEP
12288:sIz2hz0X+wo6L1+5yNOjDIiyVarGHZ1dDH7AP6mZEZXtShskE4/X:sIz2WLL1POrywrGHTdJmhhxX
Static task
static1
Behavioral task
behavioral1
Sample
new order.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
new order.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.issltd.org - Port:
587 - Username:
[email protected] - Password:
iss123 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.issltd.org - Port:
587 - Username:
[email protected] - Password:
iss123
Targets
-
-
Target
new order.exe
-
Size
639KB
-
MD5
6098971efea18e9a0bb04138ebbd5ce5
-
SHA1
3b71989c7a25e2c5aec153b4c9bde732e6064342
-
SHA256
e1cc58feb8e61c491f7e3a5821def10c1c3447e55ea68734e2311e852670a387
-
SHA512
ca6bd8b96011aa59ade0424fe6dd8ee53b36d53ccf92fd7ebbc2a345aaeea4f4f0abd10846afaccb7aa007730705cebfefc1247a5d24625e4b0ef564df606bf7
-
SSDEEP
12288:fxLQaueH5qjNvCECQnrL7Yp937GHr5Z7APYmhEZIS66SiFtf4V:fxJqjNvCCrL7W37GHr9m44
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-