General
-
Target
a9c310861b7b0eab4b5f00ad0c69d6adb3526d9e9be7cc46ff392ff76ba9da7f
-
Size
760KB
-
Sample
240612-b4n6zayalr
-
MD5
ea273fdf24f6fc9c25d3177e14c9773f
-
SHA1
67c86b2a39cb119cf400cc46f51fb63b27ebb117
-
SHA256
a9c310861b7b0eab4b5f00ad0c69d6adb3526d9e9be7cc46ff392ff76ba9da7f
-
SHA512
01d48e063a803c07c0d722cfbb5f4dea2f925ca5f7fade06c8a33607272b3e9862f4d2d3a892f79306e99c8481d757bbc22b59f902b889f2b071ff5828202579
-
SSDEEP
12288:q2kqSD3HH3DI+/zJbBvK9m5Y/cDsWWR5x50nlOJX9Jm/29rQfD5jUAkDJ:rkqSjH3DIMVhK9m5wZh5yOPu4rOVjUAW
Static task
static1
Behavioral task
behavioral1
Sample
a9c310861b7b0eab4b5f00ad0c69d6adb3526d9e9be7cc46ff392ff76ba9da7f.exe
Resource
win7-20240508-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.pgsu.co.id - Port:
587 - Username:
[email protected] - Password:
Vecls16@Vezs - Email To:
[email protected]
Targets
-
-
Target
a9c310861b7b0eab4b5f00ad0c69d6adb3526d9e9be7cc46ff392ff76ba9da7f
-
Size
760KB
-
MD5
ea273fdf24f6fc9c25d3177e14c9773f
-
SHA1
67c86b2a39cb119cf400cc46f51fb63b27ebb117
-
SHA256
a9c310861b7b0eab4b5f00ad0c69d6adb3526d9e9be7cc46ff392ff76ba9da7f
-
SHA512
01d48e063a803c07c0d722cfbb5f4dea2f925ca5f7fade06c8a33607272b3e9862f4d2d3a892f79306e99c8481d757bbc22b59f902b889f2b071ff5828202579
-
SSDEEP
12288:q2kqSD3HH3DI+/zJbBvK9m5Y/cDsWWR5x50nlOJX9Jm/29rQfD5jUAkDJ:rkqSjH3DIMVhK9m5wZh5yOPu4rOVjUAW
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-