General
-
Target
6958edff030f068a9f5635d6eeb4a61ded0529f5fb9f6d7eca6ae1a79f0ba7c4
-
Size
709KB
-
Sample
240329-blzvraeb95
-
MD5
7ca0e6c3fe6efbaec5af029c7af74ea7
-
SHA1
1a4398c8d844b6f3f4ccbe08b4693d533c127f89
-
SHA256
6958edff030f068a9f5635d6eeb4a61ded0529f5fb9f6d7eca6ae1a79f0ba7c4
-
SHA512
18a93b8906ed704527ee06b385ad23419604bf31ab76426a8bbf0c021dffd851af838680c92ae575e88c6766d0889d9c2dcbb6440f3fb1182280c99c67209069
-
SSDEEP
12288:ZU0YOwq/eSznWnbtJSNQxiPHnJ/dMwJOivzleZ9UwSzaQ84fLVFqprcSkR:+O7/jznqtJSJPJFzMbrSzGa
Static task
static1
Behavioral task
behavioral1
Sample
6958edff030f068a9f5635d6eeb4a61ded0529f5fb9f6d7eca6ae1a79f0ba7c4.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
6958edff030f068a9f5635d6eeb4a61ded0529f5fb9f6d7eca6ae1a79f0ba7c4.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.rackhost.hu - Port:
587 - Username:
[email protected] - Password:
talisan.hu - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.rackhost.hu - Port:
587 - Username:
[email protected] - Password:
talisan.hu
Targets
-
-
Target
6958edff030f068a9f5635d6eeb4a61ded0529f5fb9f6d7eca6ae1a79f0ba7c4
-
Size
709KB
-
MD5
7ca0e6c3fe6efbaec5af029c7af74ea7
-
SHA1
1a4398c8d844b6f3f4ccbe08b4693d533c127f89
-
SHA256
6958edff030f068a9f5635d6eeb4a61ded0529f5fb9f6d7eca6ae1a79f0ba7c4
-
SHA512
18a93b8906ed704527ee06b385ad23419604bf31ab76426a8bbf0c021dffd851af838680c92ae575e88c6766d0889d9c2dcbb6440f3fb1182280c99c67209069
-
SSDEEP
12288:ZU0YOwq/eSznWnbtJSNQxiPHnJ/dMwJOivzleZ9UwSzaQ84fLVFqprcSkR:+O7/jznqtJSJPJFzMbrSzGa
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-