General
-
Target
99a565b1df705062e82bd4d7587c2959.bin
-
Size
2KB
-
Sample
240328-ce1n5sae69
-
MD5
358de422745ac7f4eb02accb8b8d8a40
-
SHA1
ea7fe1428283659f46fb17dfc4091eef3c0eaedf
-
SHA256
b3c70bb891c0a16d527097628195d6804556e300b3746d19e5f3820455d91e2e
-
SHA512
55da9cbdc45c9568a53e4adbf43698d3636fbed64c2122f00cf4f0f55203e7657a5c4018efaf98a0b4aaa248dd245ca9e727e7e23cbf07ff592839b9c7b1a6f1
Static task
static1
Behavioral task
behavioral1
Sample
e8fac55896700a6e6505cc1b8d4f98570358c0a1275564d587845cfb5ec47068.rtf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e8fac55896700a6e6505cc1b8d4f98570358c0a1275564d587845cfb5ec47068.rtf
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.gosportz.in - Port:
587 - Username:
sales@gosportz.in - Password:
Ss@gosportz - Email To:
info.superseal@yandex.com
Targets
-
-
Target
e8fac55896700a6e6505cc1b8d4f98570358c0a1275564d587845cfb5ec47068.rtf
-
Size
3KB
-
MD5
99a565b1df705062e82bd4d7587c2959
-
SHA1
1817b3ef54cf96f71bbb581ef21c37c820c125f0
-
SHA256
e8fac55896700a6e6505cc1b8d4f98570358c0a1275564d587845cfb5ec47068
-
SHA512
6893bb6540e7c92cb2d39dae83dd7e16a5ed0cc8bc468e13d65dc1a4e5b909bc9a249b306323167a986ee199b6ff6a9d444b673028e4b92aeb9b0b62607ed15c
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-