General
-
Target
AWB#150322.exe
-
Size
896KB
-
Sample
240515-nfenvaeh4x
-
MD5
d51167204eaddf8cc0d55866c33abeee
-
SHA1
e845049d510aa853557da8b95ae4bd2a92b72777
-
SHA256
7e061451c71974b0e9d15f94244cf03dd147911392c5b66f47372253dea56821
-
SHA512
302f0038cff73eab86ae668d2c0de891c89884d4cf8f1bbb5a7dbdaecf7119d19a5a6da690fc36e82688a79e5d3bffe3ed0d6275deeee5bdec61a45a7cffc357
-
SSDEEP
24576:f5Cr4qOAlRZLMaBGWDorLqu6nnO8VWk8ABTXbg:f5Cr41S7UXquCnOkBz8
Static task
static1
Behavioral task
behavioral1
Sample
AWB#150322.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
AWB#150322.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.clslk.com - Port:
587 - Username:
[email protected] - Password:
NUZRATHinam1978 - Email To:
[email protected]
Targets
-
-
Target
AWB#150322.exe
-
Size
896KB
-
MD5
d51167204eaddf8cc0d55866c33abeee
-
SHA1
e845049d510aa853557da8b95ae4bd2a92b72777
-
SHA256
7e061451c71974b0e9d15f94244cf03dd147911392c5b66f47372253dea56821
-
SHA512
302f0038cff73eab86ae668d2c0de891c89884d4cf8f1bbb5a7dbdaecf7119d19a5a6da690fc36e82688a79e5d3bffe3ed0d6275deeee5bdec61a45a7cffc357
-
SSDEEP
24576:f5Cr4qOAlRZLMaBGWDorLqu6nnO8VWk8ABTXbg:f5Cr41S7UXquCnOkBz8
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-