General
-
Target
2438dd28084106aa7730863e38b4c63e1db3ee2dd0f05bcdc3fb5211381b6a36
-
Size
929KB
-
Sample
240522-clt5yaha34
-
MD5
50eca18e3c2efc7a5a64c45592cbdb97
-
SHA1
81fe9938c7635fc9dbf87280f8464d80bf236763
-
SHA256
2438dd28084106aa7730863e38b4c63e1db3ee2dd0f05bcdc3fb5211381b6a36
-
SHA512
d612f304b0cf18abe2b5289d37c022c7b27f760f7c2dcf85d854838ece837856e608301f9a267a2995bb55c589915a52e1dd09b549327402851c13979ccf496d
-
SSDEEP
24576:ja1cH3vFsIeks70E82a4f0CdrZH7o7um2:+KH/FBVs72qcCdrt7Ium2
Static task
static1
Behavioral task
behavioral1
Sample
2438dd28084106aa7730863e38b4c63e1db3ee2dd0f05bcdc3fb5211381b6a36.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2438dd28084106aa7730863e38b4c63e1db3ee2dd0f05bcdc3fb5211381b6a36.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cojosem.com - Port:
587 - Username:
[email protected] - Password:
ZARHLOULBOSS123 - Email To:
[email protected]
Targets
-
-
Target
2438dd28084106aa7730863e38b4c63e1db3ee2dd0f05bcdc3fb5211381b6a36
-
Size
929KB
-
MD5
50eca18e3c2efc7a5a64c45592cbdb97
-
SHA1
81fe9938c7635fc9dbf87280f8464d80bf236763
-
SHA256
2438dd28084106aa7730863e38b4c63e1db3ee2dd0f05bcdc3fb5211381b6a36
-
SHA512
d612f304b0cf18abe2b5289d37c022c7b27f760f7c2dcf85d854838ece837856e608301f9a267a2995bb55c589915a52e1dd09b549327402851c13979ccf496d
-
SSDEEP
24576:ja1cH3vFsIeks70E82a4f0CdrZH7o7um2:+KH/FBVs72qcCdrt7Ium2
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-