General
-
Target
9a71fbe977c8db9b96f804494901b49117db817bce171818140629a345b7eeaf.exe
-
Size
668KB
-
Sample
240329-cywjjafh36
-
MD5
503cdfe56819696af4c1336045ff6ca7
-
SHA1
b44c671486cd3f5341ebe42567d9d5c7abadf079
-
SHA256
9a71fbe977c8db9b96f804494901b49117db817bce171818140629a345b7eeaf
-
SHA512
6fdf9005c2e22c85a6cb1a2aa72fc53a3e53128b66695d79ed3825e85d04fb7ca15197c20a09d987e4c44309a30b766e5b2f604455b7faa7106a314a02686072
-
SSDEEP
12288:9d1JsJ6SSR1Sh2iNwIHLgjseXBEOPETAHEP8PWuuDpqGTTrvPWZHOQ1S:9d1w1GVjseqaNkPCu4WXXAd
Static task
static1
Behavioral task
behavioral1
Sample
9a71fbe977c8db9b96f804494901b49117db817bce171818140629a345b7eeaf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9a71fbe977c8db9b96f804494901b49117db817bce171818140629a345b7eeaf.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mbarieservicesltd.com - Port:
587 - Username:
[email protected] - Password:
*o9H+18Q4%;M - Email To:
[email protected]
Targets
-
-
Target
9a71fbe977c8db9b96f804494901b49117db817bce171818140629a345b7eeaf.exe
-
Size
668KB
-
MD5
503cdfe56819696af4c1336045ff6ca7
-
SHA1
b44c671486cd3f5341ebe42567d9d5c7abadf079
-
SHA256
9a71fbe977c8db9b96f804494901b49117db817bce171818140629a345b7eeaf
-
SHA512
6fdf9005c2e22c85a6cb1a2aa72fc53a3e53128b66695d79ed3825e85d04fb7ca15197c20a09d987e4c44309a30b766e5b2f604455b7faa7106a314a02686072
-
SSDEEP
12288:9d1JsJ6SSR1Sh2iNwIHLgjseXBEOPETAHEP8PWuuDpqGTTrvPWZHOQ1S:9d1w1GVjseqaNkPCu4WXXAd
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4.
-
Detects executables packed with SmartAssembly
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-