General
-
Target
4cc0d670a83c5a2ff6a007334791c22d50595b6e533509fc991da21346913182
-
Size
710KB
-
Sample
240426-cdqgsahb4x
-
MD5
bbbf2f01e96709bae55c957bb8866504
-
SHA1
3c717465003874f31534d629cdd0e267e52a6615
-
SHA256
4cc0d670a83c5a2ff6a007334791c22d50595b6e533509fc991da21346913182
-
SHA512
3542e4d2521cdfdde02f13cd4ff19400bce6bdf3c86d9d944c8952b08eb502b61554b9711762bd8ba42b9fbfabdce8a2a8bcc80e9037c3a90f286edfd5075dea
-
SSDEEP
12288:2WYIPXjxannnHg2mRwzRYkuPwwCUHELwOb5eP965jW3FwG4chEg0nsk8Wq:2WYIPFannnHg2mRwziPxCbLvbg965pj4
Static task
static1
Behavioral task
behavioral1
Sample
4cc0d670a83c5a2ff6a007334791c22d50595b6e533509fc991da21346913182.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
4cc0d670a83c5a2ff6a007334791c22d50595b6e533509fc991da21346913182.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.jspkragujevac.rs - Port:
587 - Username:
e-racun@jspkragujevac.rs - Password:
LA5dv##fbU%5 - Email To:
chibuike57@proton.me
Targets
-
-
Target
4cc0d670a83c5a2ff6a007334791c22d50595b6e533509fc991da21346913182
-
Size
710KB
-
MD5
bbbf2f01e96709bae55c957bb8866504
-
SHA1
3c717465003874f31534d629cdd0e267e52a6615
-
SHA256
4cc0d670a83c5a2ff6a007334791c22d50595b6e533509fc991da21346913182
-
SHA512
3542e4d2521cdfdde02f13cd4ff19400bce6bdf3c86d9d944c8952b08eb502b61554b9711762bd8ba42b9fbfabdce8a2a8bcc80e9037c3a90f286edfd5075dea
-
SSDEEP
12288:2WYIPXjxannnHg2mRwzRYkuPwwCUHELwOb5eP965jW3FwG4chEg0nsk8Wq:2WYIPFannnHg2mRwziPxCbLvbg965pj4
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1