General
-
Target
62ed0ee9372f04bd637e3995624dbc0c.bin
-
Size
643KB
-
Sample
240330-brr24adh5z
-
MD5
e62a2111a7e69314308103cc0494143f
-
SHA1
64394519c5f849e2d7b4fc14c1a4e35fff97625f
-
SHA256
0539e1d634e283f5d4d4d39439c3e60a58253c8e43bb6e6787917e5f307ed4dc
-
SHA512
5c2b141ac4f6c8ee36aec3c4e76a2992d63a819603b74ca18cf2fc309cec2569718dc01baddea8f3349b369b72bf8d8fec8d67e668499f56ab8fb7a617d83dab
-
SSDEEP
12288:n+i+VoR87fDhd/4U0t6OgUcvy0ivYQVptcTqJxma+2t/8gkcA+i6p3Ci0+XDJupH:n+i58T/z0t67Ucbiv9xc2Jx7+2t/E/5J
Static task
static1
Behavioral task
behavioral1
Sample
17f1c3567b5334eca6e41e7a341faa999fdb22f64004a185874e23dd4a43d06d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
17f1c3567b5334eca6e41e7a341faa999fdb22f64004a185874e23dd4a43d06d.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.sigmamotorspk.com - Port:
587 - Username:
[email protected] - Password:
zarbeazab1234 - Email To:
[email protected]
Targets
-
-
Target
17f1c3567b5334eca6e41e7a341faa999fdb22f64004a185874e23dd4a43d06d.exe
-
Size
687KB
-
MD5
62ed0ee9372f04bd637e3995624dbc0c
-
SHA1
96e4d381325b9c0a0581993529baf0cb38050faf
-
SHA256
17f1c3567b5334eca6e41e7a341faa999fdb22f64004a185874e23dd4a43d06d
-
SHA512
7e3c79a487e8d472947aab1050db828ae7fe65ae1af049c00dfe7cd1b4668313665dd6380a32b7465a16da292e8270e53c35586ea39dcef3ec50ddc8a1bd2e1a
-
SSDEEP
12288:4/K0YOwqOpWXqqfNg3Hsgtwmq+MzaMl7+fpfKIIP9HJYxbd:DO7rXHNg3HsgtwD+MzplCfxKzHJI
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-