General
-
Target
d4bd02001663c31220d193b31dc12111beb945ed218472479d928615c027bf50
-
Size
760KB
-
Sample
240523-bsmtrsgd8s
-
MD5
ca65dd11a660c5644eac207286b48ad1
-
SHA1
d58c861528aa3a04e1c5d86036a323aba6dec704
-
SHA256
d4bd02001663c31220d193b31dc12111beb945ed218472479d928615c027bf50
-
SHA512
a0ca089a0a5a1d84afe7a096cf1d11cdac7b906db9f336e13cd8098fdabd2c04265bc16cda5e00fa9cc7b600e859a98dd2b4ab81788b6571b12021783ebaadb4
-
SSDEEP
12288:Xqx504bFtx504bFWxIhfo7bV9x8prgg1OIAuJljzlNSTq8hmbz0RkCsyJ+pf4URS:aw4bjw4b1h0jShgg1lAuJlPv58hmbzeV
Static task
static1
Behavioral task
behavioral1
Sample
d4bd02001663c31220d193b31dc12111beb945ed218472479d928615c027bf50.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
d4bd02001663c31220d193b31dc12111beb945ed218472479d928615c027bf50.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mbarieservicesltd.com - Port:
587 - Username:
[email protected] - Password:
*o9H+18Q4%;M - Email To:
[email protected]
Targets
-
-
Target
d4bd02001663c31220d193b31dc12111beb945ed218472479d928615c027bf50
-
Size
760KB
-
MD5
ca65dd11a660c5644eac207286b48ad1
-
SHA1
d58c861528aa3a04e1c5d86036a323aba6dec704
-
SHA256
d4bd02001663c31220d193b31dc12111beb945ed218472479d928615c027bf50
-
SHA512
a0ca089a0a5a1d84afe7a096cf1d11cdac7b906db9f336e13cd8098fdabd2c04265bc16cda5e00fa9cc7b600e859a98dd2b4ab81788b6571b12021783ebaadb4
-
SSDEEP
12288:Xqx504bFtx504bFWxIhfo7bV9x8prgg1OIAuJljzlNSTq8hmbz0RkCsyJ+pf4URS:aw4bjw4b1h0jShgg1lAuJlPv58hmbzeV
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-