General
-
Target
Jykpxb.bat
-
Size
276KB
-
Sample
240426-r13sysee5x
-
MD5
2c111f46d26f1352673ae6dc86a990fe
-
SHA1
a523fdff3ae3672b0f815c8af3ef0b3982b841d6
-
SHA256
5f175835c666dba497ed962c90679fc4c61b84a021f68ebb900a0d5d5b660d32
-
SHA512
6c4ff1a335d5b8671da3e3cc178bb5ae345e45c262617a58087e36260a346fb8ee699d9db057336ea412e11e2288e9ace76c741ee5c6fc18fb91e0206e51c7ff
-
SSDEEP
6144:i4c7tvCwj2O9lT+TIvZCoJZP2xwrpuHeAFUhhmPhLkJRC:AKwRwkImzs/Mh2gJA
Static task
static1
Behavioral task
behavioral1
Sample
Jykpxb.bat
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Jykpxb.bat
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
proglass.com.sg - Port:
587 - Username:
admin1@proglass.com.sg - Password:
BillionPay$ - Email To:
administrator@proglass.com.sg
Targets
-
-
Target
Jykpxb.bat
-
Size
276KB
-
MD5
2c111f46d26f1352673ae6dc86a990fe
-
SHA1
a523fdff3ae3672b0f815c8af3ef0b3982b841d6
-
SHA256
5f175835c666dba497ed962c90679fc4c61b84a021f68ebb900a0d5d5b660d32
-
SHA512
6c4ff1a335d5b8671da3e3cc178bb5ae345e45c262617a58087e36260a346fb8ee699d9db057336ea412e11e2288e9ace76c741ee5c6fc18fb91e0206e51c7ff
-
SSDEEP
6144:i4c7tvCwj2O9lT+TIvZCoJZP2xwrpuHeAFUhhmPhLkJRC:AKwRwkImzs/Mh2gJA
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-