General
-
Target
8e4478e88d353adaff12fb98536a0ef94634ff732143464c62bbe895025c8b25
-
Size
671KB
-
Sample
240523-cdzepahf21
-
MD5
7aff4a0d96c31e6575e812a8ca863ba2
-
SHA1
b21ea3ba817589aa43ee69a43e26a2963d86e81d
-
SHA256
8e4478e88d353adaff12fb98536a0ef94634ff732143464c62bbe895025c8b25
-
SHA512
b143cf6b15ca49e4211b7428f7ff246e52f59804d00aae06337b54e009b4560c1b53d34a56d63fa390329cf70ebb225ffb7e3b2d4b048316ad0292c3a2c01636
-
SSDEEP
12288:tqwi8LkpEayVOgJafiWoryZHBIHfwNqpnnWnu8T4UbZ3qK3Y9qXLPwlAJ6quufqy:tqPjEpVrJaKXWPI/woJW+Oq2XzweJ6qr
Static task
static1
Behavioral task
behavioral1
Sample
8e4478e88d353adaff12fb98536a0ef94634ff732143464c62bbe895025c8b25.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
8e4478e88d353adaff12fb98536a0ef94634ff732143464c62bbe895025c8b25.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
nl9.nlkoddos.com - Port:
587 - Username:
[email protected] - Password:
Myname321@ - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
nl9.nlkoddos.com - Port:
587 - Username:
[email protected] - Password:
Myname321@
Targets
-
-
Target
8e4478e88d353adaff12fb98536a0ef94634ff732143464c62bbe895025c8b25
-
Size
671KB
-
MD5
7aff4a0d96c31e6575e812a8ca863ba2
-
SHA1
b21ea3ba817589aa43ee69a43e26a2963d86e81d
-
SHA256
8e4478e88d353adaff12fb98536a0ef94634ff732143464c62bbe895025c8b25
-
SHA512
b143cf6b15ca49e4211b7428f7ff246e52f59804d00aae06337b54e009b4560c1b53d34a56d63fa390329cf70ebb225ffb7e3b2d4b048316ad0292c3a2c01636
-
SSDEEP
12288:tqwi8LkpEayVOgJafiWoryZHBIHfwNqpnnWnu8T4UbZ3qK3Y9qXLPwlAJ6quufqy:tqPjEpVrJaKXWPI/woJW+Oq2XzweJ6qr
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-