General
-
Target
ee8f7f19cae2355f44cb6846a44719a8beeaf69aa2e36a808c05ff17042c1a27
-
Size
8.8MB
-
Sample
240425-b4g3nadb8w
-
MD5
456ed09672818939fec8a9cf807b5443
-
SHA1
2a52e10017b9db4ae79406fcb7a43f90f5e4d04e
-
SHA256
ee8f7f19cae2355f44cb6846a44719a8beeaf69aa2e36a808c05ff17042c1a27
-
SHA512
1e06c000f06891cd51c5653458876c464b50026625e47d794f46694e663d20c331de3c61237f1b4a207172777d3018621c452a27cfd9999d8714bab380479fbd
-
SSDEEP
196608:FNfI8+9fpUgVf4ba76AkLrWVu6rzRwkTp7R1VK6HUGiBKbBJdWfid4fJ82q15u7r:FNfI8+9fpUgVf4ba76AkLrWVu6rzRwkY
Static task
static1
Behavioral task
behavioral1
Sample
ee8f7f19cae2355f44cb6846a44719a8beeaf69aa2e36a808c05ff17042c1a27.exe
Resource
win7-20240215-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.gencoldfire.com - Port:
587 - Username:
[email protected] - Password:
mh7B/7[hSO#bYHw1 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.gencoldfire.com - Port:
587 - Username:
[email protected] - Password:
mh7B/7[hSO#bYHw1
Targets
-
-
Target
ee8f7f19cae2355f44cb6846a44719a8beeaf69aa2e36a808c05ff17042c1a27
-
Size
8.8MB
-
MD5
456ed09672818939fec8a9cf807b5443
-
SHA1
2a52e10017b9db4ae79406fcb7a43f90f5e4d04e
-
SHA256
ee8f7f19cae2355f44cb6846a44719a8beeaf69aa2e36a808c05ff17042c1a27
-
SHA512
1e06c000f06891cd51c5653458876c464b50026625e47d794f46694e663d20c331de3c61237f1b4a207172777d3018621c452a27cfd9999d8714bab380479fbd
-
SSDEEP
196608:FNfI8+9fpUgVf4ba76AkLrWVu6rzRwkTp7R1VK6HUGiBKbBJdWfid4fJ82q15u7r:FNfI8+9fpUgVf4ba76AkLrWVu6rzRwkY
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-