General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.16545.13591.exe
-
Size
662KB
-
Sample
240429-spk97sea9y
-
MD5
c6897fbd058549c3c2182697d175d406
-
SHA1
b206b0a3917b860be47077baf30ea50ea71995f2
-
SHA256
c6ef25196d351077b5f73d55948ca5209c9bc230222b150593ac949cad0ad4d0
-
SHA512
e3c8cded974f35ea695f964ba1bcf444e2d7e18a1396b0bd25b478312d368cd8378fd6686b6e22619c92fa26ab1926e19939a38d5faa9a60930f5d4537e1206d
-
SSDEEP
12288:JaSB778Q44tyqbsRD92pCRnmQ4G/0FDqz7F+cXbD6vECsnTe:sSBC48qgRD9WS/mDqz7ocXbDuECsT
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.PWSX-gen.16545.13591.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.PWSX-gen.16545.13591.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
goodwillapparels.com - Port:
587 - Username:
[email protected] - Password:
7FdCuO!QWpHV - Email To:
[email protected]
Targets
-
-
Target
SecuriteInfo.com.Win32.PWSX-gen.16545.13591.exe
-
Size
662KB
-
MD5
c6897fbd058549c3c2182697d175d406
-
SHA1
b206b0a3917b860be47077baf30ea50ea71995f2
-
SHA256
c6ef25196d351077b5f73d55948ca5209c9bc230222b150593ac949cad0ad4d0
-
SHA512
e3c8cded974f35ea695f964ba1bcf444e2d7e18a1396b0bd25b478312d368cd8378fd6686b6e22619c92fa26ab1926e19939a38d5faa9a60930f5d4537e1206d
-
SSDEEP
12288:JaSB778Q44tyqbsRD92pCRnmQ4G/0FDqz7F+cXbD6vECsnTe:sSBC48qgRD9WS/mDqz7ocXbDuECsT
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-