General
-
Target
71e9ae14242ce87f023a9c620ecc55823b031d8e53be308ec3b59e51b8210f0b
-
Size
582KB
-
Sample
240522-b2lm3agc38
-
MD5
70a2c246b5d20605f4bbbb2ec7e0a875
-
SHA1
16d258355bbf0bb69a4eaabd9ccdee85a7bb920f
-
SHA256
71e9ae14242ce87f023a9c620ecc55823b031d8e53be308ec3b59e51b8210f0b
-
SHA512
f52a08feccb30672f6674728b8210381cf10fb48b1c89f9d7d1db61cdaccc917308ba00d46857fea49460c2edc65040147fb3ba5607774930035c52ddfc6a5f8
-
SSDEEP
12288:leOAZvF39zV5DPwx/UAN1eo7IDzhNl1fFvviNkUEXqLwZvCUOWZeMK:le1xHDPwWAPSpNvFvaeXAw4UOWG
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.window10server.com - Port:
587 - Username:
[email protected] - Password:
4eXpIcas8PADEye - Email To:
[email protected]
Targets
-
-
Target
requisition_210524_pdf.exe
-
Size
1006KB
-
MD5
7fe3e5192bd976256acb279f45e8f7f4
-
SHA1
3b96879f0698be146e3985f4b750956bcdedb9dd
-
SHA256
0a560c2937b384d39d799666d0426e8bfe9788bce3342a22a77908319d81b399
-
SHA512
73016287080fccf62b4dcaa7363801012a380ffff71952a38ad7c8334dc974a8c2041d9c22ad4f9a295a8d5ad0824878ea30f1b44504c3b357234352d06a0eab
-
SSDEEP
24576:uAHnh+eWsN3skA4RV1Hom2KXMmHaGVdmU+Wvg5:Zh+ZkldoPK8YaG3V+1
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-