General
-
Target
e4bd4c24b1c4740df71672cc54f2af139e21c88c8f294e163a47b1dcf3f92088
-
Size
689KB
-
Sample
240329-bz74aaef46
-
MD5
3518a4bf1dba9653f8bb8d4bcf538208
-
SHA1
50b3f10bf1543b030914821f51994c32a34050bc
-
SHA256
e4bd4c24b1c4740df71672cc54f2af139e21c88c8f294e163a47b1dcf3f92088
-
SHA512
8af7a21a333f158996e24b64fdb42fb316304e48c9167ce72502834a2b9a4ce36fa152c3a05e5f9016b1934959a938707507a88cf0b37b2e22c508887a31805c
-
SSDEEP
12288:M/ZU0YOwqOprqUWfecdRLOXyoC8lF23S4oKFEomgOa/z6UmEQ6fjCH/JikXMVZ5/:sIO7zfecdRLXY2ifKN8pUPhCH/JikXME
Static task
static1
Behavioral task
behavioral1
Sample
e4bd4c24b1c4740df71672cc54f2af139e21c88c8f294e163a47b1dcf3f92088.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e4bd4c24b1c4740df71672cc54f2af139e21c88c8f294e163a47b1dcf3f92088.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.egyptian-international.com - Port:
587 - Username:
[email protected] - Password:
@@Nour60008 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.egyptian-international.com - Port:
587 - Username:
[email protected] - Password:
@@Nour60008
Targets
-
-
Target
e4bd4c24b1c4740df71672cc54f2af139e21c88c8f294e163a47b1dcf3f92088
-
Size
689KB
-
MD5
3518a4bf1dba9653f8bb8d4bcf538208
-
SHA1
50b3f10bf1543b030914821f51994c32a34050bc
-
SHA256
e4bd4c24b1c4740df71672cc54f2af139e21c88c8f294e163a47b1dcf3f92088
-
SHA512
8af7a21a333f158996e24b64fdb42fb316304e48c9167ce72502834a2b9a4ce36fa152c3a05e5f9016b1934959a938707507a88cf0b37b2e22c508887a31805c
-
SSDEEP
12288:M/ZU0YOwqOprqUWfecdRLOXyoC8lF23S4oKFEomgOa/z6UmEQ6fjCH/JikXMVZ5/:sIO7zfecdRLXY2ifKN8pUPhCH/JikXME
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-