General
-
Target
630572ffb0dc40275a4645e9354c26e2673eb123bb88237abba3e905fc0073b3.exe
-
Size
1.4MB
-
Sample
231208-q1jveaaaeq
-
MD5
ee1ba5e2867849f42e5a0d7cbb8a091a
-
SHA1
6abd4142539516ba942ca352da42775c2755ffcd
-
SHA256
630572ffb0dc40275a4645e9354c26e2673eb123bb88237abba3e905fc0073b3
-
SHA512
6dce41e42e4278387eebbae857c27e57f801b269e3b601d6fbb6bba2f52c926f83fbedf1f914fe81dbcb48d0eef9907ace88f448217423896c482ad3c03c868a
-
SSDEEP
24576:Z6xtk4c+nf9n9NNbFFdXN2/1DyfKvAZVpcocH8Zxo2iotosC+W:D4cKf9n9NNbFFdXN2/oKvEP3ZOR6Cf
Static task
static1
Behavioral task
behavioral1
Sample
630572ffb0dc40275a4645e9354c26e2673eb123bb88237abba3e905fc0073b3.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
630572ffb0dc40275a4645e9354c26e2673eb123bb88237abba3e905fc0073b3.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
Protocol: smtp- Host:
server1.sqsendy.shop - Port:
587 - Username:
[email protected] - Password:
{f];qthoiBBW
Extracted
agenttesla
Protocol: smtp- Host:
server1.sqsendy.shop - Port:
587 - Username:
[email protected] - Password:
{f];qthoiBBW - Email To:
[email protected]
Targets
-
-
Target
630572ffb0dc40275a4645e9354c26e2673eb123bb88237abba3e905fc0073b3.exe
-
Size
1.4MB
-
MD5
ee1ba5e2867849f42e5a0d7cbb8a091a
-
SHA1
6abd4142539516ba942ca352da42775c2755ffcd
-
SHA256
630572ffb0dc40275a4645e9354c26e2673eb123bb88237abba3e905fc0073b3
-
SHA512
6dce41e42e4278387eebbae857c27e57f801b269e3b601d6fbb6bba2f52c926f83fbedf1f914fe81dbcb48d0eef9907ace88f448217423896c482ad3c03c868a
-
SSDEEP
24576:Z6xtk4c+nf9n9NNbFFdXN2/1DyfKvAZVpcocH8Zxo2iotosC+W:D4cKf9n9NNbFFdXN2/oKvEP3ZOR6Cf
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-