General
-
Target
6d871321364e2771a8ce334e21919b74758d9c643c5bca125fff4be96f9f5d14
-
Size
652KB
-
Sample
240417-q38asabh51
-
MD5
2b7c5139aa14a1cb8943a24c321cefed
-
SHA1
fa14307d5a7fb3c60fca62342fd762639ba12f2c
-
SHA256
6d871321364e2771a8ce334e21919b74758d9c643c5bca125fff4be96f9f5d14
-
SHA512
3fda00c93d79b18f59ef309ae221776a7178c343cbae977204d9afe5525d63977b1b97fa74b229fe2c8922dbd322f35b21f82b01b173bb60d1697bf395669a49
-
SSDEEP
12288:cqJs2Ng4S0KUnkwAD/F8LpLpv2J4u4rCoE2FTRCnJc4ldMKEEthC5QYPiZ6ejH:hs2NFSjUnQDduJpvS4rdeJ36EK5pNKH
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.pacificindia.com - Port:
587 - Username:
[email protected] - Password:
FEYEjBLgGnyw - Email To:
[email protected]
Targets
-
-
Target
e77c8ca31128a1a181b99a8234f39559854855d871d7abe167e004bb970e7f3c.exe
-
Size
744KB
-
MD5
596365c750c4f8e60a966e220e35e7d9
-
SHA1
234b7114f19589e1768670361e2a4cd7328f8c75
-
SHA256
e77c8ca31128a1a181b99a8234f39559854855d871d7abe167e004bb970e7f3c
-
SHA512
5679cc3bca181e417de60f4f8c473a17445405eb32f0e37855111ba5f6b8a95cc22225628da8c0227078177342ad3f9a1b9c3b985e04aff086d0a7e626e20047
-
SSDEEP
12288:akz4ayww0uLdzCeXEdFGpQCDsmIag2Sh7unpPcmg5I0i4DVlupWXAhT:UajazCe0dFoQQs55h7uVoG0dDVlup+
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-