General
-
Target
d0b08fe11c26fba9e4db3025907ffb321ba90bd89ddf278598549f677c730ae4
-
Size
1.8MB
-
Sample
240518-j9gyvabe5x
-
MD5
f34f8c3b88a6438c5bd5b9226f4c15e5
-
SHA1
92cf54a478d8f64b7def04ff18531d01eb8c613b
-
SHA256
d0b08fe11c26fba9e4db3025907ffb321ba90bd89ddf278598549f677c730ae4
-
SHA512
38fd22c6a92617f436e68a1cac2e21ea7bf7c298800861574fd6b28b525a591a80abaf613d15f84ec1f38a0b200d11e94f93b0f878a48e9ea09dc001441ea10e
-
SSDEEP
49152:di3IUqCNTKDN54+voakXjb/D8Tgf665TsKz1iZREujT6TW:dxUq6G5oXjHrf6rKz1iHjqW
Static task
static1
Behavioral task
behavioral1
Sample
ddc569613ec200f20166b173ad3f35bbc650561b0cf663aaca780a5c2df84c3e.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ddc569613ec200f20166b173ad3f35bbc650561b0cf663aaca780a5c2df84c3e.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.laboratoriosvilla.com.mx - Port:
587 - Username:
[email protected] - Password:
WZ,2pliw#L)D - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.laboratoriosvilla.com.mx - Port:
587 - Username:
[email protected] - Password:
WZ,2pliw#L)D
Targets
-
-
Target
ddc569613ec200f20166b173ad3f35bbc650561b0cf663aaca780a5c2df84c3e.exe
-
Size
4.4MB
-
MD5
c3912ababef8779019c4ad04389c0655
-
SHA1
a52f1a47394692712861cc083b598e23b86980c1
-
SHA256
ddc569613ec200f20166b173ad3f35bbc650561b0cf663aaca780a5c2df84c3e
-
SHA512
514fdee6216e956aef89b688a6ee44339d232aaae6d59ef7c15f4df6627c00c011dc87a3dead8b110a3c7d48b206d3b70c4e003cb240d5eac27b18b2d7c92f73
-
SSDEEP
24576:Db0NrhkmqN5OX521zGjc6A4Az79V9A75q4dIXDiPqbGJHthwlXtlRUgmQh2zcbdI:Cp
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-