General
-
Target
77e72cdfb8aaaf4966e6a5c1b92d0061351ae1730a28e5d59eaf50a31ddc8ff5
-
Size
677KB
-
Sample
240330-bk9zbsdf7z
-
MD5
5b439caef6392f97f2befc18542abef1
-
SHA1
231db601c0e0a333c1d5b2fcc3cd8129b1418d70
-
SHA256
77e72cdfb8aaaf4966e6a5c1b92d0061351ae1730a28e5d59eaf50a31ddc8ff5
-
SHA512
4d91db3946000d666e3c64db7e915ae65cc523960cb6c90a20ef8f43de99adadb577617238ca6af640a6450ad5e3dcbf117fea567bd3831953abcd9be92c2f3d
-
SSDEEP
12288:iSLK1mzj3AdWV4hivDodWmuckeOCk7eyilw4a+1/VqBnvtv:iSiejjV45d3kqJ7V1Knvtv
Static task
static1
Behavioral task
behavioral1
Sample
77e72cdfb8aaaf4966e6a5c1b92d0061351ae1730a28e5d59eaf50a31ddc8ff5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
77e72cdfb8aaaf4966e6a5c1b92d0061351ae1730a28e5d59eaf50a31ddc8ff5.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.scootero.cl - Port:
587 - Username:
[email protected] - Password:
Dangote1235$
Extracted
agenttesla
Protocol: smtp- Host:
mail.scootero.cl - Port:
587 - Username:
[email protected] - Password:
Dangote1235$ - Email To:
[email protected]
Targets
-
-
Target
77e72cdfb8aaaf4966e6a5c1b92d0061351ae1730a28e5d59eaf50a31ddc8ff5
-
Size
677KB
-
MD5
5b439caef6392f97f2befc18542abef1
-
SHA1
231db601c0e0a333c1d5b2fcc3cd8129b1418d70
-
SHA256
77e72cdfb8aaaf4966e6a5c1b92d0061351ae1730a28e5d59eaf50a31ddc8ff5
-
SHA512
4d91db3946000d666e3c64db7e915ae65cc523960cb6c90a20ef8f43de99adadb577617238ca6af640a6450ad5e3dcbf117fea567bd3831953abcd9be92c2f3d
-
SSDEEP
12288:iSLK1mzj3AdWV4hivDodWmuckeOCk7eyilw4a+1/VqBnvtv:iSiejjV45d3kqJ7V1Knvtv
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-