General
-
Target
1c8ec0370981660b66ca7342caedc14dd769c14e69e31ac5f56a33e5dd493aa4
-
Size
597KB
-
Sample
240523-cxgzraae6w
-
MD5
3a973e532aaac5586ad17a5866252494
-
SHA1
8aa037fc4a16fd88c969ab034f6b75422b238df5
-
SHA256
1c8ec0370981660b66ca7342caedc14dd769c14e69e31ac5f56a33e5dd493aa4
-
SHA512
b5aeccc1dd782bb7f2274735c0e1aed3b72aa0378ebe93ecc7b013633d4bd3d51e4f333db68b652e68639e814724e9bd12a6e530359315d6c5cd4caa20b4abd4
-
SSDEEP
12288:PHMZvF+KN5ppnfwP7dWqz9vq+cSjnMdvlXL+HhGwMaVLiIIXcqt3B4vCU:PIlLwPhWSpqvSjnMllCM7DB4vCU
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.window10server.com - Port:
587 - Username:
[email protected] - Password:
4eXpIcas8PADEye - Email To:
[email protected]
Targets
-
-
Target
shipping doc BL_CI_PL_pdf.exe
-
Size
1020KB
-
MD5
8fdddd6c1778965fa675530b23081555
-
SHA1
7d436c8232a5a6044e3c15a18d662183f16cf3ab
-
SHA256
7c365ce0e3489852c8e6680bab779495083c48961985fa64d34696b4e2e598dc
-
SHA512
d01cb45ec86daf6fceae8d45417ad7dee1c560fc41ead0133216f95d6cdec9544e947e32b750c83afee14036d5b9f05ea0e89ac52cfa5ab61e37cb44a9582712
-
SSDEEP
24576:QAHnh+eWsN3skA4RV1Hom2KXMmHay9tBlWDh5:Hh+ZkldoPK8Yay5lk
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-