General
-
Target
b48a14f185cfd77e01733db2837277db8f47d04f77e6ac7093f0a88927a115fc
-
Size
1.3MB
-
Sample
240426-ctrpsahc5v
-
MD5
280ae1955701d5f84f59ef9f5b8c7412
-
SHA1
6651afec36ec273a284886892bb22050c3f9931e
-
SHA256
b48a14f185cfd77e01733db2837277db8f47d04f77e6ac7093f0a88927a115fc
-
SHA512
e08e57ff1d43ae83451ee99844a7e755ffd3d46f972fbbb8f8779e01413e65fe27cec6701e356a0bc010b827a73045b77b44db098385109f0fa6efd52e9262ed
-
SSDEEP
24576:ksP3iN7BBmctIoM9jyTPom1msR2vzqtk9Cc2eWhCM6aHay1f5t:kpFBmcm56wGmXv2qYIWQba68D
Static task
static1
Behavioral task
behavioral1
Sample
b48a14f185cfd77e01733db2837277db8f47d04f77e6ac7093f0a88927a115fc.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b48a14f185cfd77e01733db2837277db8f47d04f77e6ac7093f0a88927a115fc.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.medicalhome.com.pe - Port:
587 - Username:
[email protected] - Password:
MHinfo01 - Email To:
[email protected]
Targets
-
-
Target
b48a14f185cfd77e01733db2837277db8f47d04f77e6ac7093f0a88927a115fc
-
Size
1.3MB
-
MD5
280ae1955701d5f84f59ef9f5b8c7412
-
SHA1
6651afec36ec273a284886892bb22050c3f9931e
-
SHA256
b48a14f185cfd77e01733db2837277db8f47d04f77e6ac7093f0a88927a115fc
-
SHA512
e08e57ff1d43ae83451ee99844a7e755ffd3d46f972fbbb8f8779e01413e65fe27cec6701e356a0bc010b827a73045b77b44db098385109f0fa6efd52e9262ed
-
SSDEEP
24576:ksP3iN7BBmctIoM9jyTPom1msR2vzqtk9Cc2eWhCM6aHay1f5t:kpFBmcm56wGmXv2qYIWQba68D
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-