General
-
Target
dcb12a9daa314143b8b8ac1a52aba595448900997c81632f907036deeac564b7
-
Size
603KB
-
Sample
240430-bnst8age4v
-
MD5
7d03f6f3b53f6f1b3698ba84031c98f6
-
SHA1
9b61ed1ca9c3e6620a9741acecebf6171058504a
-
SHA256
dcb12a9daa314143b8b8ac1a52aba595448900997c81632f907036deeac564b7
-
SHA512
661a5abfbe572ffa58a8fe1c03c928785018e7ef8b878f5aef44f1c9bc43f50ff95a6de5593a64ce489ead18c66daf88a4206400403549482b1e5ce8f7635c87
-
SSDEEP
6144:fcR5c4ceHHFWE5emG6eUg36bHwP2w4F2m0hcxfboob:0jcb7UKxD4F8huvb
Static task
static1
Behavioral task
behavioral1
Sample
dcb12a9daa314143b8b8ac1a52aba595448900997c81632f907036deeac564b7.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
dcb12a9daa314143b8b8ac1a52aba595448900997c81632f907036deeac564b7.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
business29.web-hosting.com - Port:
587 - Username:
[email protected] - Password:
Esupofo234@ - Email To:
[email protected]
Targets
-
-
Target
dcb12a9daa314143b8b8ac1a52aba595448900997c81632f907036deeac564b7
-
Size
603KB
-
MD5
7d03f6f3b53f6f1b3698ba84031c98f6
-
SHA1
9b61ed1ca9c3e6620a9741acecebf6171058504a
-
SHA256
dcb12a9daa314143b8b8ac1a52aba595448900997c81632f907036deeac564b7
-
SHA512
661a5abfbe572ffa58a8fe1c03c928785018e7ef8b878f5aef44f1c9bc43f50ff95a6de5593a64ce489ead18c66daf88a4206400403549482b1e5ce8f7635c87
-
SSDEEP
6144:fcR5c4ceHHFWE5emG6eUg36bHwP2w4F2m0hcxfboob:0jcb7UKxD4F8huvb
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-