General
-
Target
1060c376ca5aaa3f3f294a4118209f645d1db4f1c8788f7424376d23889be864
-
Size
693KB
-
Sample
231212-cn7h2seef5
-
MD5
c1f0e8aa7f02901f5161c3e71f04ecb4
-
SHA1
3619db7c226a71b1705c8802935f4f7e32006546
-
SHA256
1060c376ca5aaa3f3f294a4118209f645d1db4f1c8788f7424376d23889be864
-
SHA512
4e91a5601734d516fbefd40c656f89a10ff325c561c8703c6da833efd064e38904264ac5a7ca3bfb283120aefd0ae9702adf68df41382f0b58952b0e1e9c636b
-
SSDEEP
12288:Z3IU8S6eUdob1XWtvtECGFMrxuxxjsMns/P4jQHm1sbRNKGMw6B+Ou+tboc5:RItSAd9v+C1uXgMnSZm4KGhqjJbj5
Static task
static1
Behavioral task
behavioral1
Sample
1060c376ca5aaa3f3f294a4118209f645d1db4f1c8788f7424376d23889be864.exe
Resource
win7-20231020-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.coaatja.com - Port:
587 - Username:
[email protected] - Password:
consuelo63
Extracted
agenttesla
Protocol: smtp- Host:
mail.coaatja.com - Port:
587 - Username:
[email protected] - Password:
consuelo63 - Email To:
[email protected]
Targets
-
-
Target
1060c376ca5aaa3f3f294a4118209f645d1db4f1c8788f7424376d23889be864
-
Size
693KB
-
MD5
c1f0e8aa7f02901f5161c3e71f04ecb4
-
SHA1
3619db7c226a71b1705c8802935f4f7e32006546
-
SHA256
1060c376ca5aaa3f3f294a4118209f645d1db4f1c8788f7424376d23889be864
-
SHA512
4e91a5601734d516fbefd40c656f89a10ff325c561c8703c6da833efd064e38904264ac5a7ca3bfb283120aefd0ae9702adf68df41382f0b58952b0e1e9c636b
-
SSDEEP
12288:Z3IU8S6eUdob1XWtvtECGFMrxuxxjsMns/P4jQHm1sbRNKGMw6B+Ou+tboc5:RItSAd9v+C1uXgMnSZm4KGhqjJbj5
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-