General
-
Target
Loading Advice.zip
-
Size
639KB
-
Sample
240330-bjwejsed57
-
MD5
3e2a8dc25924ebcd4077a536b65982cb
-
SHA1
485e8cd5e6eff1705ed0f8679ac10c949627ccea
-
SHA256
aa9422b99ef5c3e4176166a72def257d40974bb7b7cd9ec87fdf3179224ea013
-
SHA512
2417fe16cf5e74e9efe3da58a5fc59a30bfc7adfadb8634c4dae74cc20c3bba62213370105d07cffb65cc6e1b5d892b92566f79d08871afa86d4bee64d9b9ae4
-
SSDEEP
12288:jaIrso6/BwNBFFi8Cw1pOvXcgywZx14KoTOe4/alSgLty:pso6/0BFX+s+xaKIOdbgLA
Static task
static1
Behavioral task
behavioral1
Sample
Loading Advice.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Loading Advice.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.shivomrealty.com - Port:
587 - Username:
[email protected] - Password:
Priya1982# - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.shivomrealty.com - Port:
587 - Username:
[email protected] - Password:
Priya1982#
Targets
-
-
Target
Loading Advice.exe
-
Size
670KB
-
MD5
0e2cf387d4c9e428e4fe7426267dcf78
-
SHA1
6b9d263c151a33ed3f4a190ff946d52220e0f4f9
-
SHA256
4f632d095e16ece2c5dfae8a7960012ae4c94d5d8420c1a4370161d7eb2cf16d
-
SHA512
fb006aefc41f72b39ab9c6d45056af8bc8c52ade79aa4991977535632075ee555d74495eae741c9a19c28461d3da853d8d07d8ceaba8364c0e2fdd46d614ccc4
-
SSDEEP
12288:B7NtLK1lOYgzMEcgyAZx94KgLGeq/tsWzsCywR8Sk4:hicNQ+xCKaGhloPT
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-