General
-
Target
812ca7d05e97f367b5d9782645c7c0fd66b20b9c2aba0d1ea3eba0d19ca1dc00
-
Size
1.1MB
-
Sample
240424-bs1qmadf62
-
MD5
ff64e9285c8e375844d235273f0f448f
-
SHA1
c6b6cd5e38bb97d01fd28f1ed1fb8b9b4c865dd4
-
SHA256
812ca7d05e97f367b5d9782645c7c0fd66b20b9c2aba0d1ea3eba0d19ca1dc00
-
SHA512
3030659cd73af6ab0835de2c73a8abcb2428d41e8cb1e244c12101daccfcb3d6295ebc2e877d157f155155a6a91ed68ca4a3e5b6ba15d45c814b2bb034d96797
-
SSDEEP
24576:SKt7gbn23riq/GaNJjiIZGo0r0oWDNMtOuVoIQmMYCIFUpSmnS1HMV:p
Static task
static1
Behavioral task
behavioral1
Sample
812ca7d05e97f367b5d9782645c7c0fd66b20b9c2aba0d1ea3eba0d19ca1dc00.rtf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
812ca7d05e97f367b5d9782645c7c0fd66b20b9c2aba0d1ea3eba0d19ca1dc00.rtf
Resource
win10v2004-20240412-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.nizagorjemalo.hr - Port:
587 - Username:
[email protected] - Password:
Extreme192 - Email To:
[email protected]
Targets
-
-
Target
812ca7d05e97f367b5d9782645c7c0fd66b20b9c2aba0d1ea3eba0d19ca1dc00
-
Size
1.1MB
-
MD5
ff64e9285c8e375844d235273f0f448f
-
SHA1
c6b6cd5e38bb97d01fd28f1ed1fb8b9b4c865dd4
-
SHA256
812ca7d05e97f367b5d9782645c7c0fd66b20b9c2aba0d1ea3eba0d19ca1dc00
-
SHA512
3030659cd73af6ab0835de2c73a8abcb2428d41e8cb1e244c12101daccfcb3d6295ebc2e877d157f155155a6a91ed68ca4a3e5b6ba15d45c814b2bb034d96797
-
SSDEEP
24576:SKt7gbn23riq/GaNJjiIZGo0r0oWDNMtOuVoIQmMYCIFUpSmnS1HMV:p
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-