General
-
Target
INSTALLATION BOQ KATSINA.exe
-
Size
1.0MB
-
Sample
240522-rra2ksec8w
-
MD5
ccdd09951364a23f760ac5b6425dabe4
-
SHA1
00f370ab98cbbd7cb81b522b52154859240a1f7c
-
SHA256
988cecb39c8ff652b9f6f677c11c53279ffb166608acf3cbd4aa7cafc6019800
-
SHA512
c0d7f193e92060a14eed04e867a4b57004e0acd63118e97f921e9d6707242ad8e62a744ab4f6f1f7ed8776df0ffd3c5738bae2fd74d60da977b5fb8d751e1fa4
-
SSDEEP
24576:2R+ow4bjw4b0LqM4oxEK8GPMdiXCC3MkejWIF5y73:2Rrw4bjw4b0/XPMdiyC3M/So5E3
Static task
static1
Behavioral task
behavioral1
Sample
INSTALLATION BOQ KATSINA.exe
Resource
win7-20240215-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.greenimpressionbd.com - Port:
587 - Username:
[email protected] - Password:
Rumizaman123 - Email To:
[email protected]
Targets
-
-
Target
INSTALLATION BOQ KATSINA.exe
-
Size
1.0MB
-
MD5
ccdd09951364a23f760ac5b6425dabe4
-
SHA1
00f370ab98cbbd7cb81b522b52154859240a1f7c
-
SHA256
988cecb39c8ff652b9f6f677c11c53279ffb166608acf3cbd4aa7cafc6019800
-
SHA512
c0d7f193e92060a14eed04e867a4b57004e0acd63118e97f921e9d6707242ad8e62a744ab4f6f1f7ed8776df0ffd3c5738bae2fd74d60da977b5fb8d751e1fa4
-
SSDEEP
24576:2R+ow4bjw4b0LqM4oxEK8GPMdiXCC3MkejWIF5y73:2Rrw4bjw4b0/XPMdiyC3M/So5E3
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-