General
-
Target
f457e5bf42cab1972ff3b83dceba3bf770d924cd44983e66f1164af0a02a68e7
-
Size
359KB
-
Sample
240425-db7tqaec6y
-
MD5
3d8387165f598a91bed3e01226eeb361
-
SHA1
734a62f0a6857685948e103371141ab0ea671a88
-
SHA256
f457e5bf42cab1972ff3b83dceba3bf770d924cd44983e66f1164af0a02a68e7
-
SHA512
82586f6f0a7aa698e6528967a1b6063e25cb71fb4b3f00fbc404df8ce23e7a858494e718e1ed61837b2c8059b2e3272eba271a3524b78c1ed227f65e7d02d4c3
-
SSDEEP
6144:8GAnVFGQrkX66k7RT42dhRF7JcaDUmPnSF+jwqw5G9Zo8EytGN5kSll:V4Gj1wlLRFl5UAn1q44Io
Static task
static1
Behavioral task
behavioral1
Sample
f457e5bf42cab1972ff3b83dceba3bf770d924cd44983e66f1164af0a02a68e7.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f457e5bf42cab1972ff3b83dceba3bf770d924cd44983e66f1164af0a02a68e7.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
Protocol: smtp- Host:
gridplant.xyz - Port:
587 - Username:
[email protected] - Password:
24/7TryLock!!
Extracted
agenttesla
Protocol: smtp- Host:
gridplant.xyz - Port:
587 - Username:
[email protected] - Password:
24/7TryLock!! - Email To:
[email protected]
Targets
-
-
Target
f457e5bf42cab1972ff3b83dceba3bf770d924cd44983e66f1164af0a02a68e7
-
Size
359KB
-
MD5
3d8387165f598a91bed3e01226eeb361
-
SHA1
734a62f0a6857685948e103371141ab0ea671a88
-
SHA256
f457e5bf42cab1972ff3b83dceba3bf770d924cd44983e66f1164af0a02a68e7
-
SHA512
82586f6f0a7aa698e6528967a1b6063e25cb71fb4b3f00fbc404df8ce23e7a858494e718e1ed61837b2c8059b2e3272eba271a3524b78c1ed227f65e7d02d4c3
-
SSDEEP
6144:8GAnVFGQrkX66k7RT42dhRF7JcaDUmPnSF+jwqw5G9Zo8EytGN5kSll:V4Gj1wlLRFl5UAn1q44Io
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-