General
-
Target
818c1d4d7b71a802240c5b04010c0929.bin
-
Size
634KB
-
Sample
240329-cv1dbafc5z
-
MD5
fd58295fc9870b8b9c6569c1fab5881c
-
SHA1
9cbeec5234b24cec2140de6a4a7357e5d4a26eab
-
SHA256
5ef54546f5fa8df146ad0f61c94bf08391c5ae1ffc7ae78a291624e70655b363
-
SHA512
5412bd98125d0554d3aa72152e8aa2062fffba67d0dd9940af689a6da0a2f2d55a83808669a630fdc03a5f04daee3f4f1e739b6c90f5ac93e2af73fc0e98e67c
-
SSDEEP
12288:SPmFruWEcVPYMY595GEEnlw4Wvw8r5Vm9eSMmBcGjpldNxjiGnja8UyR:SertnZWv1eBbDeOXUyR
Static task
static1
Behavioral task
behavioral1
Sample
b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.oceanskylogistics.in - Port:
587 - Username:
[email protected] - Password:
Oce@n@1234 - Email To:
[email protected]
Targets
-
-
Target
b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe
-
Size
660KB
-
MD5
818c1d4d7b71a802240c5b04010c0929
-
SHA1
21ab4b40707da5ccdadf53c37458cc5b5ea674a7
-
SHA256
b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a
-
SHA512
fb4e9f6eb2b8b4e1f5e9e3b332a3bc40297f69924c60c052632e68ba44e666c2ceea9b5dc2b6aeb0125ebb03b722e5b1668c8ad90618e0a2e96e2c892584892a
-
SSDEEP
12288:aH2iNlw09szFS6U2/fdkuj+JvDUPXn1+hVh7ziEy27/MxC1GKuMDwK5J8XVhB+g:01XKC2XdLj+JLSX1kEE/M4wK/wK5qVH9
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-