General
-
Target
34a6209e1b5514ac0d575d5cf0b6453135dfdab81169207a2162763f46d24987
-
Size
8.8MB
-
Sample
240426-cg8sjahb98
-
MD5
65c1fa8d5b16889c823090165d0a87ce
-
SHA1
8040909cb66b5254acd7a59ccda780a4e4d594b1
-
SHA256
34a6209e1b5514ac0d575d5cf0b6453135dfdab81169207a2162763f46d24987
-
SHA512
444f70357d2e249a034190692063808557b7f6aa6fcf0a2dbb362c8c3d2f3aa6135eb2ecde1811ad0fae734575e4f15089fa7b4de73035c0a23f00e26767a9f4
-
SSDEEP
196608:X5rR04kTS0Dr+FSHYmwT1uKeGtyQe180u82ST3yux7Hmw+GfYr/Vv9id2Ky9iZdY:X5rR04kTS0Dr+FSHYmwT1uKeGtyQe187
Static task
static1
Behavioral task
behavioral1
Sample
34a6209e1b5514ac0d575d5cf0b6453135dfdab81169207a2162763f46d24987.exe
Resource
win7-20240221-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.gencoldfire.com - Port:
587 - Username:
mozin@gencoldfire.com - Password:
%j#!%z2b/?qM68K# - Email To:
molog@gencoldfire.com
Extracted
Protocol: smtp- Host:
mail.gencoldfire.com - Port:
587 - Username:
mozin@gencoldfire.com - Password:
%j#!%z2b/?qM68K#
Targets
-
-
Target
34a6209e1b5514ac0d575d5cf0b6453135dfdab81169207a2162763f46d24987
-
Size
8.8MB
-
MD5
65c1fa8d5b16889c823090165d0a87ce
-
SHA1
8040909cb66b5254acd7a59ccda780a4e4d594b1
-
SHA256
34a6209e1b5514ac0d575d5cf0b6453135dfdab81169207a2162763f46d24987
-
SHA512
444f70357d2e249a034190692063808557b7f6aa6fcf0a2dbb362c8c3d2f3aa6135eb2ecde1811ad0fae734575e4f15089fa7b4de73035c0a23f00e26767a9f4
-
SSDEEP
196608:X5rR04kTS0Dr+FSHYmwT1uKeGtyQe180u82ST3yux7Hmw+GfYr/Vv9id2Ky9iZdY:X5rR04kTS0Dr+FSHYmwT1uKeGtyQe187
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-