General
-
Target
23d02b6091e2bd44aef9b235c03425244118b095efe85f11f0dfbdd0b509e2f9
-
Size
706KB
-
Sample
240327-cq85naac87
-
MD5
40b1a8b76a21edecb727c6fa728f8dce
-
SHA1
c3b018dcbaee10aa089efde0bb5e0e1ba3501e14
-
SHA256
23d02b6091e2bd44aef9b235c03425244118b095efe85f11f0dfbdd0b509e2f9
-
SHA512
3da447f6f63fdd458a17a755e211e46eb55d40fd09b47067eaf81a2f383d29c70a2915eb6d65a45b6b755c4dcbf8246cb466a6d7df9d82f2345a1c350d3f6d94
-
SSDEEP
12288:vCvz+a5Wky7luYj06Gwt+Syu2aEqpIK190zYv7c8bqcwOSb:a76z7luYwLSybaEO/ozYDJmca
Static task
static1
Behavioral task
behavioral1
Sample
23d02b6091e2bd44aef9b235c03425244118b095efe85f11f0dfbdd0b509e2f9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
23d02b6091e2bd44aef9b235c03425244118b095efe85f11f0dfbdd0b509e2f9.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.nogamobilya.com - Port:
587 - Username:
[email protected] - Password:
121121.1.noga! - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.nogamobilya.com - Port:
587 - Username:
[email protected] - Password:
121121.1.noga!
Targets
-
-
Target
23d02b6091e2bd44aef9b235c03425244118b095efe85f11f0dfbdd0b509e2f9
-
Size
706KB
-
MD5
40b1a8b76a21edecb727c6fa728f8dce
-
SHA1
c3b018dcbaee10aa089efde0bb5e0e1ba3501e14
-
SHA256
23d02b6091e2bd44aef9b235c03425244118b095efe85f11f0dfbdd0b509e2f9
-
SHA512
3da447f6f63fdd458a17a755e211e46eb55d40fd09b47067eaf81a2f383d29c70a2915eb6d65a45b6b755c4dcbf8246cb466a6d7df9d82f2345a1c350d3f6d94
-
SSDEEP
12288:vCvz+a5Wky7luYj06Gwt+Syu2aEqpIK190zYv7c8bqcwOSb:a76z7luYwLSybaEO/ozYDJmca
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-