General
-
Target
276f9055909174b4cf05748f028a3f0cf9c33bc371200b1d0e9c366a1b92e003.rar
-
Size
547KB
-
Sample
240524-qrsqysfh49
-
MD5
9c03ad5c78cb4fd7336e380bd842f2aa
-
SHA1
bcd1cc7e41daed5bb3e29d2509caf674d228cee2
-
SHA256
276f9055909174b4cf05748f028a3f0cf9c33bc371200b1d0e9c366a1b92e003
-
SHA512
eea725a53d788db2e414207525350d4deadeec753f9e287597ea7816f906362b73db80cc57479eb36924f1c66df36fa19af5db747c0f0f35f42e2d143ebacfe7
-
SSDEEP
12288:/7+yoJkZW4WYmuHQ+Q2mfbIcA119V/L9bSrbSvc0n/4E4Dq:T+vJkZQuHQpMcA9VjwQ4EP
Static task
static1
Behavioral task
behavioral1
Sample
Quotation - 00645.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Quotation - 00645.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mbarieservicesltd.com - Port:
587 - Username:
[email protected] - Password:
*o9H+18Q4%;M - Email To:
[email protected]
Targets
-
-
Target
Quotation - 00645.exe
-
Size
811KB
-
MD5
42f4ad74b08ac8e44928083706bc422a
-
SHA1
6e7082c542a8a1ed54fa7287d163e64eba98ee4f
-
SHA256
ba38c374f40119a4acbdab2bc171043b87bae2d299b2628f2a02da87e851c97f
-
SHA512
a281a626525da1db4b166711e7cbc23e76ce7bcfaf9d8e5f550461b9b7016bd834961ee2824134334c20c011434c61b8b5a44d3e9e8d875c8380883f3adfafad
-
SSDEEP
12288:08ps2o+FgfSy9Sm9LrvwJhlfydchnczs04mIXeY14:08pHhdy9SBffjhcoZhV1
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-