General
-
Target
26042024_1450_26042024_Orders-2604_24.rar
-
Size
200KB
-
Sample
240426-qzfflacg88
-
MD5
325a1bf88b0c70c153ced5d4d27da116
-
SHA1
4ad19f21287e8bef2015829fbafd1dd15957d352
-
SHA256
f0ca1a2c20c1e9fee04a65e9244e81ea2360ed23556bbdac5df86e1032f31178
-
SHA512
f95cc52448da366c9057b9e21bffe4725080928ef077b704627a5d2928dfcef0eeee0c73de267bb87ec9c1c04f74a9f3092068ff88cd3dc9a89802ef35e80d05
-
SSDEEP
3072:JXEI/ZCK+6jAsMYj0LAuOWRpCNB26x+S0V+4jnjY4+MuDyM8N0mvXv4HzC8iUGGB:HbssMy0suBWm++Pfc4+NdOdmfvlYRtQl
Static task
static1
Behavioral task
behavioral1
Sample
Orders-2604_24.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Orders-2604_24.vbs
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
proglass.com.sg - Port:
587 - Username:
admin1@proglass.com.sg - Password:
BillionPay$ - Email To:
administrator@proglass.com.sg
Targets
-
-
Target
Orders-2604_24.vbs
-
Size
296KB
-
MD5
b6c156a6ddcc914249b7316bd49401e9
-
SHA1
16feeb332df9a7d664a548cfcf2c5ae79878ae08
-
SHA256
80d66a927ede02982222ad5ec0b000e0ee696476724d480980d6a4009a59ddb9
-
SHA512
dd6e13dce798e1820403cb2922c7d69894cd44d064dca32c8876165df34eebd3331b72e1f3b0bbd83585d9b9830ecfe7f06fd1daca8f9ecf38f59c31e69028bb
-
SSDEEP
6144:2c7tvCwj2O9lT+TIvZCoJZP2xwrpuHeAFUhhmPhLkJRY:vKwRwkImzs/Mh2gJ6
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-