General
-
Target
39675c989c2e7950604b300f0bb7618e3946f81c0008e81b0efd014f602fc65d
-
Size
649KB
-
Sample
240524-dmhc7sba2t
-
MD5
383a1df6b312cb85413013f4eba97e98
-
SHA1
e8720c12a7ce5e7c50d1c8cc0c3513da013bc420
-
SHA256
39675c989c2e7950604b300f0bb7618e3946f81c0008e81b0efd014f602fc65d
-
SHA512
20b7c826de91bb0d623921d20ba8cc9f243506d8a024f5026a87e5c4cb5552970245a3cb5d829a19efa441be318af35669e7a03dc8473cbb075957c690ded62b
-
SSDEEP
12288:fpSUIUcQ3W8PwPRvrn5nmhZ3YsdIVV0yqkbqb0iCslc14aUe3d:fpkUcSW8Wk3heVFqkI0idlc2ahN
Static task
static1
Behavioral task
behavioral1
Sample
0500_20191029131605_001.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0500_20191029131605_001.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.naubahar.com - Port:
587 - Username:
[email protected] - Password:
Hum$885+Nn - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.naubahar.com - Port:
587 - Username:
[email protected] - Password:
Hum$885+Nn
Targets
-
-
Target
0500_20191029131605_001.exe
-
Size
933KB
-
MD5
cdf4efcdfddf7aee33f6e712dc72182f
-
SHA1
c52218f48baa0e614d42d891c05fab90a8fcd7dd
-
SHA256
b83f874c7659698b5302b3580c95caa08ddaec3df2be44fcb232ec3a834a5aa8
-
SHA512
c2265275305bc29f8e4906ebf9cc7934c39f6c852b1b76ba6ab415842348dabb28289050ab45e7f37b345bd4bdfa39c49715a080e5044746615da1873982474e
-
SSDEEP
12288:RwZjlpbsbRThn5PmFGYGLqx/1i0WxsAk5qT6qCCVHgYF5xkR:iZjngrpYwkc6qbVAws
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1