General
-
Target
6234259f72b83e53b94e1f502f2b6d392cb3652d7bcb0908235d3c7f2faca951
-
Size
433KB
-
Sample
240424-bprnjsde7s
-
MD5
b14705de1ee244a7adfc5fca4aca36bf
-
SHA1
3a9a95af7b1089e798a2dfe7b76e577a357b45a5
-
SHA256
6234259f72b83e53b94e1f502f2b6d392cb3652d7bcb0908235d3c7f2faca951
-
SHA512
762ed314e293a8d40a5596baafd693628a8209d9922bce68ed991886a8e0c1a10846758d56320f1a6904a3ab2c622682f82c7d19da22936c15653341a29deb60
-
SSDEEP
12288:jZ7g+3lqGZ6hgC1jeeN1wN2t8Vk7mP5JgbDjamdLWQ:17g+30ngCBeecct8KBxWQ
Static task
static1
Behavioral task
behavioral1
Sample
6234259f72b83e53b94e1f502f2b6d392cb3652d7bcb0908235d3c7f2faca951.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
6234259f72b83e53b94e1f502f2b6d392cb3652d7bcb0908235d3c7f2faca951.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.gfs-ld.com - Port:
587 - Username:
[email protected] - Password:
@WlgG%V9 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
smtp.gfs-ld.com - Port:
587 - Username:
[email protected] - Password:
@WlgG%V9
Targets
-
-
Target
6234259f72b83e53b94e1f502f2b6d392cb3652d7bcb0908235d3c7f2faca951
-
Size
433KB
-
MD5
b14705de1ee244a7adfc5fca4aca36bf
-
SHA1
3a9a95af7b1089e798a2dfe7b76e577a357b45a5
-
SHA256
6234259f72b83e53b94e1f502f2b6d392cb3652d7bcb0908235d3c7f2faca951
-
SHA512
762ed314e293a8d40a5596baafd693628a8209d9922bce68ed991886a8e0c1a10846758d56320f1a6904a3ab2c622682f82c7d19da22936c15653341a29deb60
-
SSDEEP
12288:jZ7g+3lqGZ6hgC1jeeN1wN2t8Vk7mP5JgbDjamdLWQ:17g+30ngCBeecct8KBxWQ
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-