General
-
Target
c4e9963d13348a68742fdfb05d1b686849581899f7db23870c560f10dc3ba05a
-
Size
649KB
-
Sample
240602-bhxafsde7x
-
MD5
fa12168225a10aaa5e01b15d8ea7dbd5
-
SHA1
a4edc4cfb13bcd1de0863e255b81b57f1972410c
-
SHA256
c4e9963d13348a68742fdfb05d1b686849581899f7db23870c560f10dc3ba05a
-
SHA512
1e6299aa4b8c586ddb0b92a4136e737528b4fe6e5c300b0395596b5b6e0009d429eddb90183e04222b8a435cb9a47397a672c62a2fc2c490fcd245438467bec5
-
SSDEEP
12288:FXgtvRchavhpeCOYp0/OASjZndhz+syZsRLFeNR2pI9QJPfekWb2zN7K9M:OtNgYnpdJeIFene/WCztK9M
Static task
static1
Behavioral task
behavioral1
Sample
STATEMENT OF ACCOUNT.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
STATEMENT OF ACCOUNT.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.springandsummer.lk - Port:
587 - Username:
[email protected] - Password:
anu##323 - Email To:
[email protected]
Targets
-
-
Target
STATEMENT OF ACCOUNT.exe
-
Size
678KB
-
MD5
a6860f38da5460092e32e7d3ad40d73b
-
SHA1
35105d4db8c8e4953741b45b66b7dda4557e4513
-
SHA256
364c37d1a5142ecaaeabce403a7809a109348f94afd4fc547d862ed9b0f83bee
-
SHA512
c3c12ce308ddbcf215ddab0d1d5b3ff25ae963d0024d93bfd7e807b7a1bbf6b239f206ba007ea9bf512837608fd658a3994bc91d993f3204e25178ada0783116
-
SSDEEP
12288:av3XNuRchUsEcC8Yps/OACjZndhizPiI7vylo9QJHfekWb2DPR07kR:cEsZY5pdQxvvI/WCDz
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-