General
-
Target
5bba3ac716e0424075e871139cd0f3450d4105881be3964f16139baa3df76dae
-
Size
2.5MB
-
Sample
240522-bwt29agc3w
-
MD5
e889ce33072adfe939ed9f3b7d5ea7c1
-
SHA1
dac9b7fdea6ec0e22c363718b9637e1d4611e95f
-
SHA256
5bba3ac716e0424075e871139cd0f3450d4105881be3964f16139baa3df76dae
-
SHA512
f03238696fce1ae0976703c76445386e1bf7e76e1f6f901a463a43e4dad809f5efe2cfb719f40819e8f7a04180d3c3d675313f12841a3d8495ca9760ae9814f0
-
SSDEEP
49152:7P6hSrcCPT0JZLg31+mYGnKDyTXAqZrL:cuj2mYGnKDyTAq
Static task
static1
Behavioral task
behavioral1
Sample
5bba3ac716e0424075e871139cd0f3450d4105881be3964f16139baa3df76dae.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5bba3ac716e0424075e871139cd0f3450d4105881be3964f16139baa3df76dae.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
@#Qwerty12345 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
@#Qwerty12345
Targets
-
-
Target
5bba3ac716e0424075e871139cd0f3450d4105881be3964f16139baa3df76dae
-
Size
2.5MB
-
MD5
e889ce33072adfe939ed9f3b7d5ea7c1
-
SHA1
dac9b7fdea6ec0e22c363718b9637e1d4611e95f
-
SHA256
5bba3ac716e0424075e871139cd0f3450d4105881be3964f16139baa3df76dae
-
SHA512
f03238696fce1ae0976703c76445386e1bf7e76e1f6f901a463a43e4dad809f5efe2cfb719f40819e8f7a04180d3c3d675313f12841a3d8495ca9760ae9814f0
-
SSDEEP
49152:7P6hSrcCPT0JZLg31+mYGnKDyTXAqZrL:cuj2mYGnKDyTAq
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-