General
-
Target
6494DE6AD9F8E4C7420FB05EBDB459E8
-
Size
672KB
-
Sample
240328-j3srrsgb2t
-
MD5
6494de6ad9f8e4c7420fb05ebdb459e8
-
SHA1
0675d36114a1e0216d07f87d628c98932a306828
-
SHA256
1bf32bf5ebd1d4c265b2476570ef45b81608546e7f7ffaa7893a32648d2826d0
-
SHA512
225e3bf688f899f3be2ee3b7117e886725690cfb5530746503af6b004f80983cae5cdb7231a91a1d26408672acdb774909a85158fb2da11a4822b1cf2744335a
-
SSDEEP
12288:iV0YOwq04nat//d7d1sXNkLQhD27KXQ0Fusfojc52EZHjzLSn:iLO7mlk9kLQhDwpRjqZDnSn
Static task
static1
Behavioral task
behavioral1
Sample
6494DE6AD9F8E4C7420FB05EBDB459E8.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
6494DE6AD9F8E4C7420FB05EBDB459E8.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.afamiahotelresort.com - Port:
587 - Username:
r.issa@afamiahotelresort.com - Password:
AfamiaIT@20164 - Email To:
vibha.inext360@gmail.com
Extracted
Protocol: smtp- Host:
mail.afamiahotelresort.com - Port:
587 - Username:
r.issa@afamiahotelresort.com - Password:
AfamiaIT@20164
Targets
-
-
Target
6494DE6AD9F8E4C7420FB05EBDB459E8
-
Size
672KB
-
MD5
6494de6ad9f8e4c7420fb05ebdb459e8
-
SHA1
0675d36114a1e0216d07f87d628c98932a306828
-
SHA256
1bf32bf5ebd1d4c265b2476570ef45b81608546e7f7ffaa7893a32648d2826d0
-
SHA512
225e3bf688f899f3be2ee3b7117e886725690cfb5530746503af6b004f80983cae5cdb7231a91a1d26408672acdb774909a85158fb2da11a4822b1cf2744335a
-
SSDEEP
12288:iV0YOwq04nat//d7d1sXNkLQhD27KXQ0Fusfojc52EZHjzLSn:iLO7mlk9kLQhDwpRjqZDnSn
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1