General
-
Target
8d7bbdce1886333961594b60339584d5.bin
-
Size
642KB
-
Sample
240330-bz59paeb5x
-
MD5
cc4c579f4ebd2ebf91a09021b65ea930
-
SHA1
f00b4877228ab5b0a635142c708efea1d480d0ea
-
SHA256
0aff1b4bf066323c06f27d5bef33536e73ce2af134be73fdb90f5dc4479db8ca
-
SHA512
ed7c7b7df651a3b11d1a66690c09571c1b665df81a0ec0b891c02a983768aa7891872e452309f970b1e0163dc0293a655fc0f774faa90750b7d9fd51f266cf47
-
SSDEEP
12288:hcaKu/AgFtPimjzO1honmor7j6nWDNmBYqEUu6TqJdrjZQdz5asEyzKNGEx:hcjMVFpimfFZr7jfRmBREN6TqzjZQV5q
Static task
static1
Behavioral task
behavioral1
Sample
KhT.scr
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
KhT.scr
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.sigmamotorspk.com - Port:
587 - Username:
[email protected] - Password:
zarbeazab1234 - Email To:
[email protected]
Targets
-
-
Target
KhT.scr
-
Size
687KB
-
MD5
62ed0ee9372f04bd637e3995624dbc0c
-
SHA1
96e4d381325b9c0a0581993529baf0cb38050faf
-
SHA256
17f1c3567b5334eca6e41e7a341faa999fdb22f64004a185874e23dd4a43d06d
-
SHA512
7e3c79a487e8d472947aab1050db828ae7fe65ae1af049c00dfe7cd1b4668313665dd6380a32b7465a16da292e8270e53c35586ea39dcef3ec50ddc8a1bd2e1a
-
SSDEEP
12288:4/K0YOwqOpWXqqfNg3Hsgtwmq+MzaMl7+fpfKIIP9HJYxbd:DO7rXHNg3HsgtwD+MzplCfxKzHJI
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-