General
-
Target
74d7b6ba069fd8b31301ac82a559388c943f4a5cde467eb7d20cef6acedde847
-
Size
744KB
-
Sample
240419-2127jaag2z
-
MD5
9f81e28b66e52aa09b12509ef5f64739
-
SHA1
2134ee7311f8a4e60fadf90632e2cecdb536b4e6
-
SHA256
74d7b6ba069fd8b31301ac82a559388c943f4a5cde467eb7d20cef6acedde847
-
SHA512
0d1d9bbeead0e4d6253ec535d95fa0a03dc14599fd48e3978258e2ae94f4c426b5b5a342b4cd54484c1f8f313bd6a849df0c5a0a505ca4dba555a82195f67901
-
SSDEEP
12288:1GEK/pbMFUBSc4qieRMPP/D8xfV7aFmtfoBIWjfjPqBnQ0cYnORwwAFk:8EiMc4pCMfDSVv5oBIWfPqBn6YOgk
Static task
static1
Behavioral task
behavioral1
Sample
74d7b6ba069fd8b31301ac82a559388c943f4a5cde467eb7d20cef6acedde847.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
74d7b6ba069fd8b31301ac82a559388c943f4a5cde467eb7d20cef6acedde847.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.oceanskylogistics.in - Port:
587 - Username:
shipping@oceanskylogistics.in - Password:
Shipping@224554 - Email To:
bkhin.supply@gmail.com
Targets
-
-
Target
74d7b6ba069fd8b31301ac82a559388c943f4a5cde467eb7d20cef6acedde847
-
Size
744KB
-
MD5
9f81e28b66e52aa09b12509ef5f64739
-
SHA1
2134ee7311f8a4e60fadf90632e2cecdb536b4e6
-
SHA256
74d7b6ba069fd8b31301ac82a559388c943f4a5cde467eb7d20cef6acedde847
-
SHA512
0d1d9bbeead0e4d6253ec535d95fa0a03dc14599fd48e3978258e2ae94f4c426b5b5a342b4cd54484c1f8f313bd6a849df0c5a0a505ca4dba555a82195f67901
-
SSDEEP
12288:1GEK/pbMFUBSc4qieRMPP/D8xfV7aFmtfoBIWjfjPqBnQ0cYnORwwAFk:8EiMc4pCMfDSVv5oBIWfPqBn6YOgk
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects executables referencing Windows vault credential objects. Observed in infostealers
-
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
-
Detects executables referencing many email and collaboration clients. Observed in information stealers
-
Detects executables referencing many file transfer clients. Observed in information stealers
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-