General
-
Target
e65f8d2fdb468b6bc82596cb91c64e7ef3cd5ad4f5b1a5bfe8bbfbf15c918052
-
Size
632KB
-
Sample
240329-b7jewseh37
-
MD5
fdc35abe4f2ad4fac43919771f92fa1b
-
SHA1
5cdbc4a072ba78be0017b676fadc4590dcbfdb33
-
SHA256
e65f8d2fdb468b6bc82596cb91c64e7ef3cd5ad4f5b1a5bfe8bbfbf15c918052
-
SHA512
d7f77b04e8a38ec47d2d3493b5d1ed713e2bcf61f7b0216cd6e68685e05b24c43de936e4c0e510e4e9fcf11b5752d271d049921e6d48789c3dfcb8263a071cd0
-
SSDEEP
12288:Ke0yeIxcqsBnanEtdtdps7N6LQfN2hKdQ0FuOno7cn2ESnFEyKjg/U:KBScpzuB6LQfNSpb7ISNU
Static task
static1
Behavioral task
behavioral1
Sample
PO%2373182.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PO%2373182.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.afamiahotelresort.com - Port:
587 - Username:
[email protected] - Password:
AfamiaIT@20164 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.afamiahotelresort.com - Port:
587 - Username:
[email protected] - Password:
AfamiaIT@20164
Targets
-
-
Target
PO%2373182.exe
-
Size
672KB
-
MD5
6494de6ad9f8e4c7420fb05ebdb459e8
-
SHA1
0675d36114a1e0216d07f87d628c98932a306828
-
SHA256
1bf32bf5ebd1d4c265b2476570ef45b81608546e7f7ffaa7893a32648d2826d0
-
SHA512
225e3bf688f899f3be2ee3b7117e886725690cfb5530746503af6b004f80983cae5cdb7231a91a1d26408672acdb774909a85158fb2da11a4822b1cf2744335a
-
SSDEEP
12288:iV0YOwq04nat//d7d1sXNkLQhD27KXQ0Fusfojc52EZHjzLSn:iLO7mlk9kLQhDwpRjqZDnSn
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1