General
-
Target
df82d99dd3f8c4601a3d4bdf7c3b62b6
-
Size
675KB
-
Sample
240326-s1784sgd2t
-
MD5
df82d99dd3f8c4601a3d4bdf7c3b62b6
-
SHA1
51f2f44d23f70b45592a627ea5ad95cd781287c0
-
SHA256
bbca8dbd55f6feaca533c226f8c0e2af7efed8ed37772bdb8a0ff4eb5008a0fb
-
SHA512
f943a8208348caae30dfc2200927661c0f742126f3cb6615b5cf4523cabc412088d5fe2e853d6879f9048765dd4d84ece0eeabd2dc6452981cc9f20f4a4d0111
-
SSDEEP
6144:8hDANind1enPfMdAbOo37OPpAbC4d2wxPsn0JWJXDxqxaIXk3z647dFB9ri1lei2:EG2PpAC4fqxxq8wy64Tv+1leiyOnQ
Static task
static1
Behavioral task
behavioral1
Sample
df82d99dd3f8c4601a3d4bdf7c3b62b6.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
df82d99dd3f8c4601a3d4bdf7c3b62b6.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.servconsa.pe - Port:
587 - Username:
[email protected] - Password:
electricidad
Targets
-
-
Target
df82d99dd3f8c4601a3d4bdf7c3b62b6
-
Size
675KB
-
MD5
df82d99dd3f8c4601a3d4bdf7c3b62b6
-
SHA1
51f2f44d23f70b45592a627ea5ad95cd781287c0
-
SHA256
bbca8dbd55f6feaca533c226f8c0e2af7efed8ed37772bdb8a0ff4eb5008a0fb
-
SHA512
f943a8208348caae30dfc2200927661c0f742126f3cb6615b5cf4523cabc412088d5fe2e853d6879f9048765dd4d84ece0eeabd2dc6452981cc9f20f4a4d0111
-
SSDEEP
6144:8hDANind1enPfMdAbOo37OPpAbC4d2wxPsn0JWJXDxqxaIXk3z647dFB9ri1lei2:EG2PpAC4fqxxq8wy64Tv+1leiyOnQ
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-