General
-
Target
0ca593321912af3c1aaa2aef9e39f877550f8b89b96bc5b7fc82e1c1a000469a
-
Size
1.1MB
-
Sample
240427-bqcwsagh4s
-
MD5
1f910295e19660cce24650d731aaeff0
-
SHA1
de538452144b5e931c3b3fb019f86a705c1980e9
-
SHA256
0ca593321912af3c1aaa2aef9e39f877550f8b89b96bc5b7fc82e1c1a000469a
-
SHA512
3fe4d6d0522239c9a84f42e8bb265362e599363d3a605f590e808bde1bf2660ca2786a00e27e0e42df0938f19f258b49170c54286b4b12b5727dc5d411f90dc1
-
SSDEEP
24576:GV4PjKr5BNDBp+FywbcV8tZBMA4Xo41febbp1q:Nk5BNL+F7bcV8qd0bG
Static task
static1
Behavioral task
behavioral1
Sample
0ca593321912af3c1aaa2aef9e39f877550f8b89b96bc5b7fc82e1c1a000469a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0ca593321912af3c1aaa2aef9e39f877550f8b89b96bc5b7fc82e1c1a000469a.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.hoangtruongphat.com - Port:
587 - Username:
[email protected] - Password:
hoangtruongphat818 - Email To:
[email protected]
Targets
-
-
Target
0ca593321912af3c1aaa2aef9e39f877550f8b89b96bc5b7fc82e1c1a000469a
-
Size
1.1MB
-
MD5
1f910295e19660cce24650d731aaeff0
-
SHA1
de538452144b5e931c3b3fb019f86a705c1980e9
-
SHA256
0ca593321912af3c1aaa2aef9e39f877550f8b89b96bc5b7fc82e1c1a000469a
-
SHA512
3fe4d6d0522239c9a84f42e8bb265362e599363d3a605f590e808bde1bf2660ca2786a00e27e0e42df0938f19f258b49170c54286b4b12b5727dc5d411f90dc1
-
SSDEEP
24576:GV4PjKr5BNDBp+FywbcV8tZBMA4Xo41febbp1q:Nk5BNL+F7bcV8qd0bG
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-