General
-
Target
Quote UPDATE 27-03-24.exe
-
Size
668KB
-
Sample
240328-hzyyyafb9x
-
MD5
503cdfe56819696af4c1336045ff6ca7
-
SHA1
b44c671486cd3f5341ebe42567d9d5c7abadf079
-
SHA256
9a71fbe977c8db9b96f804494901b49117db817bce171818140629a345b7eeaf
-
SHA512
6fdf9005c2e22c85a6cb1a2aa72fc53a3e53128b66695d79ed3825e85d04fb7ca15197c20a09d987e4c44309a30b766e5b2f604455b7faa7106a314a02686072
-
SSDEEP
12288:9d1JsJ6SSR1Sh2iNwIHLgjseXBEOPETAHEP8PWuuDpqGTTrvPWZHOQ1S:9d1w1GVjseqaNkPCu4WXXAd
Static task
static1
Behavioral task
behavioral1
Sample
Quote UPDATE 27-03-24.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Quote UPDATE 27-03-24.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mbarieservicesltd.com - Port:
587 - Username:
saless@mbarieservicesltd.com - Password:
*o9H+18Q4%;M - Email To:
iinfo@mbarieservicesltd.com
Targets
-
-
Target
Quote UPDATE 27-03-24.exe
-
Size
668KB
-
MD5
503cdfe56819696af4c1336045ff6ca7
-
SHA1
b44c671486cd3f5341ebe42567d9d5c7abadf079
-
SHA256
9a71fbe977c8db9b96f804494901b49117db817bce171818140629a345b7eeaf
-
SHA512
6fdf9005c2e22c85a6cb1a2aa72fc53a3e53128b66695d79ed3825e85d04fb7ca15197c20a09d987e4c44309a30b766e5b2f604455b7faa7106a314a02686072
-
SSDEEP
12288:9d1JsJ6SSR1Sh2iNwIHLgjseXBEOPETAHEP8PWuuDpqGTTrvPWZHOQ1S:9d1w1GVjseqaNkPCu4WXXAd
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-