General
-
Target
1298254d450918ec0d6a4b5d5c433379ab4dd2400f05faaac525a5b30212659e
-
Size
836KB
-
Sample
240522-b76v7agf7t
-
MD5
9b2e2e8f8744108fda24cfeb7c90fbf1
-
SHA1
e8361e5daf928bdf883fd61314d26c6c05dcee48
-
SHA256
1298254d450918ec0d6a4b5d5c433379ab4dd2400f05faaac525a5b30212659e
-
SHA512
a2ef8801e9c28929f5a5ed03d25bec151c225b79cdeb1f71e4e56e282778a1c4d8450d7d15001cd44b9abdd039e0ac5cf6232095dafa8eb04f5ffbb90660d913
-
SSDEEP
24576:Cw4bjw4bp/LxjHlOZBO+Mo49/0a/F8xsKNMD7:Cw4bjw4bbkBO+OMX3a
Static task
static1
Behavioral task
behavioral1
Sample
1298254d450918ec0d6a4b5d5c433379ab4dd2400f05faaac525a5b30212659e.exe
Resource
win7-20240221-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cozuns.com - Port:
587 - Username:
[email protected] - Password:
Ku;_MUOVC3;E - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
cozuns.com - Port:
587 - Username:
[email protected] - Password:
Ku;_MUOVC3;E
Targets
-
-
Target
1298254d450918ec0d6a4b5d5c433379ab4dd2400f05faaac525a5b30212659e
-
Size
836KB
-
MD5
9b2e2e8f8744108fda24cfeb7c90fbf1
-
SHA1
e8361e5daf928bdf883fd61314d26c6c05dcee48
-
SHA256
1298254d450918ec0d6a4b5d5c433379ab4dd2400f05faaac525a5b30212659e
-
SHA512
a2ef8801e9c28929f5a5ed03d25bec151c225b79cdeb1f71e4e56e282778a1c4d8450d7d15001cd44b9abdd039e0ac5cf6232095dafa8eb04f5ffbb90660d913
-
SSDEEP
24576:Cw4bjw4bp/LxjHlOZBO+Mo49/0a/F8xsKNMD7:Cw4bjw4bbkBO+OMX3a
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-