General
-
Target
897d6faff24068f7780c2f7c2b1c9c2882efce8f8322755d512e027ea198bf90
-
Size
2.2MB
-
Sample
240426-chqy4shb99
-
MD5
d2bb042201d01ff98674d2e51b82b151
-
SHA1
b833baf9b1eb2fcbf2683abf989246269a7a4d1e
-
SHA256
897d6faff24068f7780c2f7c2b1c9c2882efce8f8322755d512e027ea198bf90
-
SHA512
b161c4dd316f904e056ab8b31aab49a176bf94702043f8cdfd6961084dc8e7c6c32d22b612227ce23004905ce02c8c0f5de2f1278aa726dfe5cde4900b977a09
-
SSDEEP
49152:GcaA4SBPkN7snLXQj6oUra6/NYzEMGt0NPRuhMMuWGkrsvtPcZx:GZA43N7+XQuoUG6FYzEME0NPRuhMMpWk
Static task
static1
Behavioral task
behavioral1
Sample
PROFORMA.exe
Resource
win7-20240221-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.gencoldfire.com - Port:
587 - Username:
mozin@gencoldfire.com - Password:
%j#!%z2b/?qM68K# - Email To:
molog@gencoldfire.com
Extracted
Protocol: smtp- Host:
mail.gencoldfire.com - Port:
587 - Username:
mozin@gencoldfire.com - Password:
%j#!%z2b/?qM68K#
Targets
-
-
Target
PROFORMA.exe
-
Size
8.8MB
-
MD5
65c1fa8d5b16889c823090165d0a87ce
-
SHA1
8040909cb66b5254acd7a59ccda780a4e4d594b1
-
SHA256
34a6209e1b5514ac0d575d5cf0b6453135dfdab81169207a2162763f46d24987
-
SHA512
444f70357d2e249a034190692063808557b7f6aa6fcf0a2dbb362c8c3d2f3aa6135eb2ecde1811ad0fae734575e4f15089fa7b4de73035c0a23f00e26767a9f4
-
SSDEEP
196608:X5rR04kTS0Dr+FSHYmwT1uKeGtyQe180u82ST3yux7Hmw+GfYr/Vv9id2Ky9iZdY:X5rR04kTS0Dr+FSHYmwT1uKeGtyQe187
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-