General
-
Target
fc24a8bf64db46711cb8ca985940dd8459aedf3a3438dec05c54db385502515d
-
Size
822KB
-
Sample
240427-b37xpagd82
-
MD5
9b7f6195f583e5ca792a4dec0b2c74ac
-
SHA1
86d5e0e2bfe0ab5c13c533d3ef6fb52d9706ad9c
-
SHA256
fc24a8bf64db46711cb8ca985940dd8459aedf3a3438dec05c54db385502515d
-
SHA512
444bb4caa43d0520210163a0ccb44a45931d5e0973b69adabfed09c9ff4ff86d0e6ba12a932316df04b1c3254bb7abbab63b13ffe24e669f01fc8a5777ecc1ac
-
SSDEEP
24576:R4PjKr5BNDSwrZPMibcPbQZkRPt0e/yBW6:qk5BNn9PM2cP/x/yBW
Static task
static1
Behavioral task
behavioral1
Sample
fc24a8bf64db46711cb8ca985940dd8459aedf3a3438dec05c54db385502515d.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
fc24a8bf64db46711cb8ca985940dd8459aedf3a3438dec05c54db385502515d.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
Password: cnM@Yak4 - Email To:
[email protected]
Targets
-
-
Target
fc24a8bf64db46711cb8ca985940dd8459aedf3a3438dec05c54db385502515d
-
Size
822KB
-
MD5
9b7f6195f583e5ca792a4dec0b2c74ac
-
SHA1
86d5e0e2bfe0ab5c13c533d3ef6fb52d9706ad9c
-
SHA256
fc24a8bf64db46711cb8ca985940dd8459aedf3a3438dec05c54db385502515d
-
SHA512
444bb4caa43d0520210163a0ccb44a45931d5e0973b69adabfed09c9ff4ff86d0e6ba12a932316df04b1c3254bb7abbab63b13ffe24e669f01fc8a5777ecc1ac
-
SSDEEP
24576:R4PjKr5BNDSwrZPMibcPbQZkRPt0e/yBW6:qk5BNn9PM2cP/x/yBW
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1