General
-
Target
AWB.zip
-
Size
663KB
-
Sample
240329-dj4r2agf37
-
MD5
340675bc6391808bc581c58a44a0ac70
-
SHA1
b6b4e0780b5ded9f76bcf46f39d0269682746649
-
SHA256
76c307b3265b16a75c9aee4cd6fc81e70e81c173fafa43289172bc1c766d4817
-
SHA512
6b7457aec588440d5baa72f5140bf3a02ed045b6958e0942a6f0b104ffb8c8f11ff8139bed30b0e615deb694ab2d0580f6f37bf1907a44de30085fa1611ca398
-
SSDEEP
12288:mrzZzS4LjTdrxV9fbhMKCWedtyp6Aot1PnwV9FrGKK6KXEtJqb9NKRtSm:0Zz7LjTdxV9fbmKbed8p6Aot1PwV9FCe
Static task
static1
Behavioral task
behavioral1
Sample
AWB.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
AWB.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.shivomrealty.com - Port:
587 - Username:
[email protected] - Password:
Priya1982# - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.shivomrealty.com - Port:
587 - Username:
[email protected] - Password:
Priya1982#
Targets
-
-
Target
AWB.exe
-
Size
725KB
-
MD5
cd3754976ede221faea878084c12f20a
-
SHA1
5034bade13d439d013bd94bc856c29aba36ce3d3
-
SHA256
0dbd99dde1de7165ccde4c0b87b7c533fb79fb3c99e59356a23f74f939d7a32d
-
SHA512
31e10adde937c0f0131928c55bbfe96377c26d03bee8e17598fdbd818a859ebd2cb3e76ac9fe25c342732061774fb58a1086dcf9910da7e25225fe9addd0011e
-
SSDEEP
12288:WyW11Sh2iNw/yBLfbBMKkWudtyH62otT3nV431hP7kH0tiYR9yqg2aVmADYZr1S:IDw1G/y5fbGKRud8H62otT3G1hgM3Ro2
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-