General
-
Target
871ae800103263eba6b125c860687fb668e67eb23fc3bcfb59d93600f31af9de
-
Size
654KB
-
Sample
240430-b2vkzage97
-
MD5
d5221b62d9b6d85f21fdea81c098ce34
-
SHA1
6bbb11ebc1974d66328bc6fcada5ac6145f39e0e
-
SHA256
871ae800103263eba6b125c860687fb668e67eb23fc3bcfb59d93600f31af9de
-
SHA512
2284acbd407269048f304cb4284b4ae68d76a9bcfbb0048028ed23ae0684218590864407e37f6631fe82a706d7c06e9858c6c1864bc97a293fc92457bee40c78
-
SSDEEP
12288:Zk//MnovU6tdDvEMCW8bxD+i3JgS7yy7jnbIHy4v8:ZuMneU6tdD8NW80pSGy7jnbs8
Static task
static1
Behavioral task
behavioral1
Sample
BL_Docs_April29.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
BL_Docs_April29.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
zqamcx.com - Port:
587 - Username:
[email protected] - Password:
Methodman991 - Email To:
[email protected]
Targets
-
-
Target
BL_Docs_April29.exe
-
Size
712KB
-
MD5
821b50ff336504c74840dc7d66a02a96
-
SHA1
aaa9215c4fbea8825d1920540639378955e62fa1
-
SHA256
d92ba5974de2d71b7dade685562677a4bb5727e3456660cebabb084e14b8ad1d
-
SHA512
4257d2a0a2601aaeeedcb58f561bd1a1bdea587bb4fbd047bc3c1c0a5e7a75c13a891c4f73eceddec2193640680db184cc411c5db0b9f83483d02e8f17e9b2f1
-
SSDEEP
12288:q+DbgHB778QehnU6tE+NBG90ex9//aTm4ZSXNR/XrRg67yyFjfbNTzLgkR:rgHBIU6tE+q95xt/ay4iXru6GyFjfbNr
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-