General
-
Target
e86b27f3edc74c02c08c0fa95289f72bd7b3c6034b7f1078106b5afd7ead520d
-
Size
1.2MB
-
Sample
240425-ddk3qsec8x
-
MD5
6a293126d26a8031094a568f07fba7bc
-
SHA1
17283b86aa07afbe2c51a1e4d296f87a8004a8b7
-
SHA256
e86b27f3edc74c02c08c0fa95289f72bd7b3c6034b7f1078106b5afd7ead520d
-
SHA512
73b5f19c05eda8774791499b233381e630ffcd3abf35e151854096da6f54cea47b9d39a70820d5f459739391b85641c8a795b1886972853fcb662667fab9da86
-
SSDEEP
24576:BXJ312Z34MIkiMS5nogJCGAUaJmwbX56:1Jl2SMxynoitBAlTE
Static task
static1
Behavioral task
behavioral1
Sample
PO72100020.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
PO72100020.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mbarieservicesltd.com - Port:
587 - Username:
[email protected] - Password:
*o9H+18Q4%;M - Email To:
[email protected]
Targets
-
-
Target
PO72100020.exe
-
Size
609KB
-
MD5
9a5c1769bfc5f864560b4b96440ef0c7
-
SHA1
f04248dcc5ab5c135eb6f92bc6c05e358fb0e352
-
SHA256
30c718c351d892844a385163620d743b9829ae751497ba6015f0c7a4815f60fb
-
SHA512
f7212d69ac737cd4c43e162ad1c3561dd6d3a0b03ac3ace35876d6c2d1d7b5624b69ad1a0cf4960ec61377c1bb57826058c22323496f1494b737e270013509df
-
SSDEEP
12288:3NgLeFR6OXlv312Z334MIhjWVE3GDiVv42QS0SnoM5MCCGqLUa/HfpalJ2bFUcNF:zXJ312Z34MIkiMS5nogJCGAUaJmwbX56
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-