General
-
Target
228dade32d54dc772e19f314063755c76ba451fadf5ab2a6e84bebf1fcd1f76f
-
Size
8.8MB
-
Sample
240425-cjxs2sde81
-
MD5
2630c3209b1fbec909b3ce157fc901b3
-
SHA1
be40d583d64339e3b0123f1df4a6e2e13e5a473b
-
SHA256
228dade32d54dc772e19f314063755c76ba451fadf5ab2a6e84bebf1fcd1f76f
-
SHA512
76e9b61d927dd0c741900311b838c4c87c5838a6a4d2042fe8e342589cdc0d9cc06b034feb2297ba19e3f35ec6c2adda7f13e47b90799b4c8ec7976bbd42a283
-
SSDEEP
196608:Mox6ro/UHDOMaNMbK3ZmjzKJhxMsY2WmJSOyvh0sHR9IEaOASv8d1Ne6hJJdyrNG:Mox6ro/UHDOMaNMbK3ZmjzKJhxMsY2Wq
Static task
static1
Behavioral task
behavioral1
Sample
228dade32d54dc772e19f314063755c76ba451fadf5ab2a6e84bebf1fcd1f76f.exe
Resource
win7-20231129-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.apexrnun.com - Port:
587 - Username:
[email protected] - Password:
CCu5Z?WuH+bS4hsz - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.apexrnun.com - Port:
587 - Username:
[email protected] - Password:
CCu5Z?WuH+bS4hsz
Targets
-
-
Target
228dade32d54dc772e19f314063755c76ba451fadf5ab2a6e84bebf1fcd1f76f
-
Size
8.8MB
-
MD5
2630c3209b1fbec909b3ce157fc901b3
-
SHA1
be40d583d64339e3b0123f1df4a6e2e13e5a473b
-
SHA256
228dade32d54dc772e19f314063755c76ba451fadf5ab2a6e84bebf1fcd1f76f
-
SHA512
76e9b61d927dd0c741900311b838c4c87c5838a6a4d2042fe8e342589cdc0d9cc06b034feb2297ba19e3f35ec6c2adda7f13e47b90799b4c8ec7976bbd42a283
-
SSDEEP
196608:Mox6ro/UHDOMaNMbK3ZmjzKJhxMsY2WmJSOyvh0sHR9IEaOASv8d1Ne6hJJdyrNG:Mox6ro/UHDOMaNMbK3ZmjzKJhxMsY2Wq
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-