General
-
Target
fd27136b421204432c52af71e8b7d3827b9312ce8bdf6e52c259fadda7318051
-
Size
670KB
-
Sample
240523-c1kvtaaf8z
-
MD5
070149e77067e63301cb7416ca33c5ca
-
SHA1
8efcc305c0f1dd154357be6db7a458d889da0d27
-
SHA256
fd27136b421204432c52af71e8b7d3827b9312ce8bdf6e52c259fadda7318051
-
SHA512
6f464162170d44c5ab9d8f55d6cdd3e685c6055639a68cc6456183787ce6e38b85e67b37c3f96c3f0643773880b6c074d56d195827af5b96b1c6fc18a098bf90
-
SSDEEP
12288:guVi8LkpEaeHDei/g9Vxrng+HjvQZlnzOLCbTG0Nc4DqsWvN76kR:guwjENHIV+Mjv2lnzOLCFK4Dqp5Z
Static task
static1
Behavioral task
behavioral1
Sample
fd27136b421204432c52af71e8b7d3827b9312ce8bdf6e52c259fadda7318051.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
fd27136b421204432c52af71e8b7d3827b9312ce8bdf6e52c259fadda7318051.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
nl9.nlkoddos.com - Port:
587 - Username:
[email protected] - Password:
Myname321@ - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
nl9.nlkoddos.com - Port:
587 - Username:
[email protected] - Password:
Myname321@
Targets
-
-
Target
fd27136b421204432c52af71e8b7d3827b9312ce8bdf6e52c259fadda7318051
-
Size
670KB
-
MD5
070149e77067e63301cb7416ca33c5ca
-
SHA1
8efcc305c0f1dd154357be6db7a458d889da0d27
-
SHA256
fd27136b421204432c52af71e8b7d3827b9312ce8bdf6e52c259fadda7318051
-
SHA512
6f464162170d44c5ab9d8f55d6cdd3e685c6055639a68cc6456183787ce6e38b85e67b37c3f96c3f0643773880b6c074d56d195827af5b96b1c6fc18a098bf90
-
SSDEEP
12288:guVi8LkpEaeHDei/g9Vxrng+HjvQZlnzOLCbTG0Nc4DqsWvN76kR:guwjENHIV+Mjv2lnzOLCFK4Dqp5Z
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-