General
-
Target
2023072401 DataMarch.rar
-
Size
66KB
-
Sample
240326-ckr9ysbf95
-
MD5
7125f9faec13b283d0a5606ef80e92e2
-
SHA1
2e7a65ecf59e3524f54be7604ea0b64a891f38a4
-
SHA256
21a1c8137bcb253a161b10f53d260c73f3b38bf5397648ccbcaf9e91066de4b7
-
SHA512
2b835b5ca3412c7c8cad6138515c06436f70a0828a58a1f93e42470831d145214b2ddf6e851a20d174017b377579ac9bee645d58974f9a41622c1ca2bcc19778
-
SSDEEP
1536:27hA8YNESvTjyWwf1hp0zU191vsDuStGtNShbQCWtzU:6nY6S3y7NhazU199CxtGtNSNmU
Static task
static1
Behavioral task
behavioral1
Sample
2023072401 DataMarch.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2023072401 DataMarch.vbs
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.myhydropowered.com - Port:
587 - Username:
[email protected] - Password:
0nVaQweHLu8RyVL - Email To:
[email protected]
Targets
-
-
Target
2023072401 DataMarch.vbs
-
Size
166KB
-
MD5
f4b9002a475115cb909549d539b624bd
-
SHA1
936174112283c206af454063673e4a068328e85b
-
SHA256
d5ff5e2daa191c35c06516f89b81bc682e7ac53bdfaea3ede48e84191532f375
-
SHA512
0013db6fdc1d0d7b7614ca639eb0f698a6cce2687eb99bfa22536b6b6731ba5c942ba57209d18c33017f6ea9ea62bad7ccb43be5d1add018713ec2d12cd8ac69
-
SSDEEP
3072:1pK6/PeadLaz+kxSzn9Lj7rZeqGbHfNcckB+HGuG5Elx7d5czQON8DyRQe2:1pKyPeadLaz+k0zn1j7rZeqGbHfNccku
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-