General
-
Target
LOADING ADVICE.zip
-
Size
663KB
-
Sample
240327-vy8szacb5z
-
MD5
6badf84464a8e59c308a8d503a465b60
-
SHA1
84beb751ec82ab35cfa6cfad8987d5a99ad14941
-
SHA256
d77744f8d3e929932a0d3de1df5c8e96c40e7616c433ee04489ff1e3a86a43f8
-
SHA512
19e4fbdeca08febbc644eb591c35f3ff107842f59994b8bfbaf8468b6350144cbd5bd2b2d05b34f1c44eae8ce53517aeec542b24d53df7b75bb144c44c268907
-
SSDEEP
12288:1rzZzS4LjTdrxV9fbhMKCWedtyp6Aot1PnwV9FrGKK6KXEtJqb9NKRtSN:ZZz7LjTdxV9fbmKbed8p6Aot1PwV9FCl
Static task
static1
Behavioral task
behavioral1
Sample
LOADING ADVICE.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
LOADING ADVICE.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.shivomrealty.com - Port:
587 - Username:
[email protected] - Password:
Priya1982# - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.shivomrealty.com - Port:
587 - Username:
[email protected] - Password:
Priya1982#
Targets
-
-
Target
LOADING ADVICE.exe
-
Size
725KB
-
MD5
cd3754976ede221faea878084c12f20a
-
SHA1
5034bade13d439d013bd94bc856c29aba36ce3d3
-
SHA256
0dbd99dde1de7165ccde4c0b87b7c533fb79fb3c99e59356a23f74f939d7a32d
-
SHA512
31e10adde937c0f0131928c55bbfe96377c26d03bee8e17598fdbd818a859ebd2cb3e76ac9fe25c342732061774fb58a1086dcf9910da7e25225fe9addd0011e
-
SSDEEP
12288:WyW11Sh2iNw/yBLfbBMKkWudtyH62otT3nV431hP7kH0tiYR9yqg2aVmADYZr1S:IDw1G/y5fbGKRud8H62otT3G1hgM3Ro2
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-