General
-
Target
FedEx_AWB#53203024643.exe
-
Size
705KB
-
Sample
240328-w92dpsdb8x
-
MD5
1c2e10456d4941fc03b4505745df986d
-
SHA1
8e4a49017e5906846ed12440dae27f7c702bc64d
-
SHA256
e9666b1c4832b4fae3effce740700f565e6336bcaf47852005c1e0553436e7b7
-
SHA512
33480167a4cb3f0703e4f053b8ad83f9b2291a804e1cf6d14c27ac9272fce414a7a5793ff6ecd36c808a085fdb6e9b41b630322fa61de4fd2baff06847c7143b
-
SSDEEP
12288:a/US0YOwqOp67LHOv8AzfetftWQkPV48wjNk+KmTGvUbIu0xCBUK4kogNCGSkR:qO7HLMzWf+CEmTGvK8CqK4kbNCGh
Static task
static1
Behavioral task
behavioral1
Sample
FedEx_AWB#53203024643.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
FedEx_AWB#53203024643.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
nl9.nlkoddos.com - Port:
587 - Username:
222@barceltricot.eu - Password:
Myname321@ - Email To:
matto2@cyberia-lb.com
Extracted
Protocol: smtp- Host:
nl9.nlkoddos.com - Port:
587 - Username:
222@barceltricot.eu - Password:
Myname321@
Targets
-
-
Target
FedEx_AWB#53203024643.exe
-
Size
705KB
-
MD5
1c2e10456d4941fc03b4505745df986d
-
SHA1
8e4a49017e5906846ed12440dae27f7c702bc64d
-
SHA256
e9666b1c4832b4fae3effce740700f565e6336bcaf47852005c1e0553436e7b7
-
SHA512
33480167a4cb3f0703e4f053b8ad83f9b2291a804e1cf6d14c27ac9272fce414a7a5793ff6ecd36c808a085fdb6e9b41b630322fa61de4fd2baff06847c7143b
-
SSDEEP
12288:a/US0YOwqOp67LHOv8AzfetftWQkPV48wjNk+KmTGvUbIu0xCBUK4kogNCGSkR:qO7HLMzWf+CEmTGvK8CqK4kbNCGh
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-