General
-
Target
2d9a4fafaa4c304036f6bf83f1d12ff858c4d90461182d4693acb34f1c1009ca
-
Size
707KB
-
Sample
240327-bwdehacb3y
-
MD5
62ebf524a14e5192ff4ff55c1a63775a
-
SHA1
646181d999ea76d63c3cb3ceb3777a85f5daf82c
-
SHA256
2d9a4fafaa4c304036f6bf83f1d12ff858c4d90461182d4693acb34f1c1009ca
-
SHA512
7e0726448b3251f578a415ca952ad1094994ebe41d18d2e452195c629a075005003dd43641649a4aad02453db60f5a27289342c4e08626fbd57e80accaff12c3
-
SSDEEP
12288:ZCCEDa5W9D458zlpM/RqKcysA12mYlUfwWJxi7+nqdfvxoHgTXyT:ADR1tJpM/RqbyymYwwAxnao8XC
Static task
static1
Behavioral task
behavioral1
Sample
2d9a4fafaa4c304036f6bf83f1d12ff858c4d90461182d4693acb34f1c1009ca.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2d9a4fafaa4c304036f6bf83f1d12ff858c4d90461182d4693acb34f1c1009ca.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
sg2plcpnl0128.prod.sin2.secureserver.net - Port:
587 - Username:
[email protected] - Password:
]EMe[F7b^j@[ - Email To:
[email protected]
Targets
-
-
Target
2d9a4fafaa4c304036f6bf83f1d12ff858c4d90461182d4693acb34f1c1009ca
-
Size
707KB
-
MD5
62ebf524a14e5192ff4ff55c1a63775a
-
SHA1
646181d999ea76d63c3cb3ceb3777a85f5daf82c
-
SHA256
2d9a4fafaa4c304036f6bf83f1d12ff858c4d90461182d4693acb34f1c1009ca
-
SHA512
7e0726448b3251f578a415ca952ad1094994ebe41d18d2e452195c629a075005003dd43641649a4aad02453db60f5a27289342c4e08626fbd57e80accaff12c3
-
SSDEEP
12288:ZCCEDa5W9D458zlpM/RqKcysA12mYlUfwWJxi7+nqdfvxoHgTXyT:ADR1tJpM/RqbyymYwwAxnao8XC
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-