General
-
Target
rPO(1437).exe
-
Size
618KB
-
Sample
231212-r4s3xsgde7
-
MD5
41c91c8f3a9d75efccd89372ecff39db
-
SHA1
325e0b574a81dd05673b1087e8ee93110d5a505d
-
SHA256
4ce5396c87f3a1c529e9f482ef25383e8e9751b39b2c0461c6f64526549fa639
-
SHA512
d8b3fc60ebefa133a67eb27b46c532145190d27b26341ca4a203d2d4559d8160a6dafb178cde53a9d9cb68b63631fe097e704d897e87ee44be7328d2831d9c68
-
SSDEEP
12288:2Z3IU8S6eUdT3AhlizaWgPxyb5VywPmSASteQgsjyGDrID12EsYRsnnIKG:2RItSAdTZrVywIuryx1h
Static task
static1
Behavioral task
behavioral1
Sample
rPO(1437).exe
Resource
win7-20231201-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.abi0expertise.com - Port:
587 - Username:
[email protected] - Password:
Najwa1949! - Email To:
[email protected]
Targets
-
-
Target
rPO(1437).exe
-
Size
618KB
-
MD5
41c91c8f3a9d75efccd89372ecff39db
-
SHA1
325e0b574a81dd05673b1087e8ee93110d5a505d
-
SHA256
4ce5396c87f3a1c529e9f482ef25383e8e9751b39b2c0461c6f64526549fa639
-
SHA512
d8b3fc60ebefa133a67eb27b46c532145190d27b26341ca4a203d2d4559d8160a6dafb178cde53a9d9cb68b63631fe097e704d897e87ee44be7328d2831d9c68
-
SSDEEP
12288:2Z3IU8S6eUdT3AhlizaWgPxyb5VywPmSASteQgsjyGDrID12EsYRsnnIKG:2RItSAdTZrVywIuryx1h
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-