General
-
Target
534c090dae9a215c0fa41c9564739ab3c3981522ef46d90a626c8ce6bbe9b6cf
-
Size
658KB
-
Sample
240330-btff3sdh9w
-
MD5
cbba7af29f5357d9d8fa45dfed4c0126
-
SHA1
6f0b422c1b712f008e3464ad0322d6ba3860bcb4
-
SHA256
534c090dae9a215c0fa41c9564739ab3c3981522ef46d90a626c8ce6bbe9b6cf
-
SHA512
11ad18fbe3db7ac496197d9ff6ea355a4e5586c06a1301049d32c052060f8b8eb3be1e337f90152498536083827a1d5d40057b141b0f839ce6a33d37668b1991
-
SSDEEP
12288:aRH2iNlw05X+3477iok6qEkz7JEKC9VjqzWtxfQuc:e1X9+o77ip6qrGKC9xrt5Q
Static task
static1
Behavioral task
behavioral1
Sample
534c090dae9a215c0fa41c9564739ab3c3981522ef46d90a626c8ce6bbe9b6cf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
534c090dae9a215c0fa41c9564739ab3c3981522ef46d90a626c8ce6bbe9b6cf.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.mail.ru - Port:
587 - Username:
[email protected] - Password:
1LV9XyFCe1kMxseW6Srz - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
smtp.mail.ru - Port:
587 - Username:
[email protected] - Password:
1LV9XyFCe1kMxseW6Srz
Targets
-
-
Target
534c090dae9a215c0fa41c9564739ab3c3981522ef46d90a626c8ce6bbe9b6cf
-
Size
658KB
-
MD5
cbba7af29f5357d9d8fa45dfed4c0126
-
SHA1
6f0b422c1b712f008e3464ad0322d6ba3860bcb4
-
SHA256
534c090dae9a215c0fa41c9564739ab3c3981522ef46d90a626c8ce6bbe9b6cf
-
SHA512
11ad18fbe3db7ac496197d9ff6ea355a4e5586c06a1301049d32c052060f8b8eb3be1e337f90152498536083827a1d5d40057b141b0f839ce6a33d37668b1991
-
SSDEEP
12288:aRH2iNlw05X+3477iok6qEkz7JEKC9VjqzWtxfQuc:e1X9+o77ip6qrGKC9xrt5Q
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-