General
-
Target
2935df092ec48ddca67da111513ad415c2f98b9043e6c11d0545f1a559d8fd8e
-
Size
649KB
-
Sample
240408-bnpskacd4v
-
MD5
bd683118c0c9e6ea4d8480b427e937d2
-
SHA1
a30d07a041817ccf344aaa35c26254f0785f796d
-
SHA256
2935df092ec48ddca67da111513ad415c2f98b9043e6c11d0545f1a559d8fd8e
-
SHA512
3aba71983ac623c6e8146d1a19bea351333ad84b9b2d55898ca665d7cb3667ade58698c5ace381d5080737976465197be2f6914934968a9c6324822da5faf8d0
-
SSDEEP
12288:jqs3/5g4wuZWXkDKDthzelFLUvEF8Wjz5iA9Ci2gTogVBsXtk:GwBgYb+D2lNoEFphiA64s
Static task
static1
Behavioral task
behavioral1
Sample
2935df092ec48ddca67da111513ad415c2f98b9043e6c11d0545f1a559d8fd8e.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
2935df092ec48ddca67da111513ad415c2f98b9043e6c11d0545f1a559d8fd8e.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
nl9.nlkoddos.com - Port:
587 - Username:
[email protected] - Password:
Myname321@ - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
nl9.nlkoddos.com - Port:
587 - Username:
[email protected] - Password:
Myname321@
Targets
-
-
Target
2935df092ec48ddca67da111513ad415c2f98b9043e6c11d0545f1a559d8fd8e
-
Size
649KB
-
MD5
bd683118c0c9e6ea4d8480b427e937d2
-
SHA1
a30d07a041817ccf344aaa35c26254f0785f796d
-
SHA256
2935df092ec48ddca67da111513ad415c2f98b9043e6c11d0545f1a559d8fd8e
-
SHA512
3aba71983ac623c6e8146d1a19bea351333ad84b9b2d55898ca665d7cb3667ade58698c5ace381d5080737976465197be2f6914934968a9c6324822da5faf8d0
-
SSDEEP
12288:jqs3/5g4wuZWXkDKDthzelFLUvEF8Wjz5iA9Ci2gTogVBsXtk:GwBgYb+D2lNoEFphiA64s
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-