General
-
Target
e10fe1fdb2c5db6fbc21c203ffa3737f
-
Size
1013KB
-
Sample
240327-hs9f4aaa6s
-
MD5
e10fe1fdb2c5db6fbc21c203ffa3737f
-
SHA1
8ab562fe60beb21a7614e2924ef6208c28d95a9c
-
SHA256
7529ab75869152bd388f0e9ed1b34b4e7c25c6bb579d36b11be2228f5eb58460
-
SHA512
9f1d72470311d980134e2a06a0c3a19dd6d082817ad3b2b1d524e930db99b9b5e690539220e699060600a28d10a36e4e84680e30d505f1f3f2821c0208d52012
-
SSDEEP
12288:l1Yq55LQJ4/RIOqgmib8WaBlKMXaGzP93ZQJe0uvjDiIL:lKk5EJ4/RIyclKMqGzFJQo3iw
Static task
static1
Behavioral task
behavioral1
Sample
e10fe1fdb2c5db6fbc21c203ffa3737f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e10fe1fdb2c5db6fbc21c203ffa3737f.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
abcd@71#
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
abcd@71#
Targets
-
-
Target
e10fe1fdb2c5db6fbc21c203ffa3737f
-
Size
1013KB
-
MD5
e10fe1fdb2c5db6fbc21c203ffa3737f
-
SHA1
8ab562fe60beb21a7614e2924ef6208c28d95a9c
-
SHA256
7529ab75869152bd388f0e9ed1b34b4e7c25c6bb579d36b11be2228f5eb58460
-
SHA512
9f1d72470311d980134e2a06a0c3a19dd6d082817ad3b2b1d524e930db99b9b5e690539220e699060600a28d10a36e4e84680e30d505f1f3f2821c0208d52012
-
SSDEEP
12288:l1Yq55LQJ4/RIOqgmib8WaBlKMXaGzP93ZQJe0uvjDiIL:lKk5EJ4/RIyclKMqGzFJQo3iw
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-