General
-
Target
206b4b5ab8a00697a7161de7822d5235e4f9d913e57e503673cc0437c2ddceb0
-
Size
643KB
-
Sample
240328-fnjzjaed7t
-
MD5
c45c19b5790cf57045ce3f8222c412f2
-
SHA1
818996bc52b3ff2d17620bb8d4902d80e7643ab6
-
SHA256
206b4b5ab8a00697a7161de7822d5235e4f9d913e57e503673cc0437c2ddceb0
-
SHA512
b87a5db0dbc25ff7b9331598607f6bca602e8167cb002adfd123d541665ff7c8fd0b88a68a990f33e3f28926b7bb2918e4054d6c1924a2eb0b42788d4e588107
-
SSDEEP
12288:wY5qjl5sV3opXxW603Hioen6ZH6i4bgc6ZLXgf4Kx6IF0TGLqk98h:wY5mvXUH30n656iXD6GIFlrO
Static task
static1
Behavioral task
behavioral1
Sample
206b4b5ab8a00697a7161de7822d5235e4f9d913e57e503673cc0437c2ddceb0.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
206b4b5ab8a00697a7161de7822d5235e4f9d913e57e503673cc0437c2ddceb0.exe
Resource
win11-20240221-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.gosportz.in - Port:
587 - Username:
sales@gosportz.in - Password:
Ss@gosportz - Email To:
cintronp44@yandex.com
Targets
-
-
Target
206b4b5ab8a00697a7161de7822d5235e4f9d913e57e503673cc0437c2ddceb0
-
Size
643KB
-
MD5
c45c19b5790cf57045ce3f8222c412f2
-
SHA1
818996bc52b3ff2d17620bb8d4902d80e7643ab6
-
SHA256
206b4b5ab8a00697a7161de7822d5235e4f9d913e57e503673cc0437c2ddceb0
-
SHA512
b87a5db0dbc25ff7b9331598607f6bca602e8167cb002adfd123d541665ff7c8fd0b88a68a990f33e3f28926b7bb2918e4054d6c1924a2eb0b42788d4e588107
-
SSDEEP
12288:wY5qjl5sV3opXxW603Hioen6ZH6i4bgc6ZLXgf4Kx6IF0TGLqk98h:wY5mvXUH30n656iXD6GIFlrO
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-