General
-
Target
assento 555 pro-Model-2.vbs
-
Size
37KB
-
Sample
240328-xama6sdc2v
-
MD5
97c163bbb028e2bb1439bbe5e9497cfe
-
SHA1
a69c484d867309e1d36f88f0edcca3cb155e25b8
-
SHA256
e74c7eeb8441dcc8faf37169cd15805f10b6a21c9982d8395728f5978622f982
-
SHA512
64e1444c4862392660ff697805b3817fcb7f5db21cb6a1cb56ed4b4e4e8e10ae067cb6c8b79dbec5a4affeb6d5b618aed0fdd87b92f489be23890236d9e6ff7e
-
SSDEEP
384:u09gBJmUIWz0AujGKoCJmMuttrW6ku83V3aiHwMgz0YaXBP2a+eGHz4b467QiBAc:u09gBJEWAZGc8NnKwiQxwZY36cuA+yBC
Static task
static1
Behavioral task
behavioral1
Sample
assento 555 pro-Model-2.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
assento 555 pro-Model-2.vbs
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.medicalhome.com.pe - Port:
587 - Username:
info@medicalhome.com.pe - Password:
MHinfo01 - Email To:
og.bahd@yandex.ru
Targets
-
-
Target
assento 555 pro-Model-2.vbs
-
Size
37KB
-
MD5
97c163bbb028e2bb1439bbe5e9497cfe
-
SHA1
a69c484d867309e1d36f88f0edcca3cb155e25b8
-
SHA256
e74c7eeb8441dcc8faf37169cd15805f10b6a21c9982d8395728f5978622f982
-
SHA512
64e1444c4862392660ff697805b3817fcb7f5db21cb6a1cb56ed4b4e4e8e10ae067cb6c8b79dbec5a4affeb6d5b618aed0fdd87b92f489be23890236d9e6ff7e
-
SSDEEP
384:u09gBJmUIWz0AujGKoCJmMuttrW6ku83V3aiHwMgz0YaXBP2a+eGHz4b467QiBAc:u09gBJEWAZGc8NnKwiQxwZY36cuA+yBC
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-