General
-
Target
401c290929faf18ea2fe4696eb2a9e971c2bdf980f3f28a1237d517489d5e053
-
Size
661KB
-
Sample
240612-btfrvaxfkm
-
MD5
601db4b94f8097f72d75b7beb086b933
-
SHA1
ec4c8e8cd2a4168cd0fb7cdb9cfcbf3384b38f2c
-
SHA256
401c290929faf18ea2fe4696eb2a9e971c2bdf980f3f28a1237d517489d5e053
-
SHA512
312f7ec9e54c6df101afb58a3f786304af6d81d956dd0f0c645767be7e5de39a284210abb0663431bbd9ee651418627ab259210093aa16d16001c46aed99e67e
-
SSDEEP
12288:Btkvq31eoWJbvukj3JjYC6RXstUBtWFF97SGi+beSgXtnuAgk7H:BteqF0zukdjqRcn2FLXluAge
Static task
static1
Behavioral task
behavioral1
Sample
401c290929faf18ea2fe4696eb2a9e971c2bdf980f3f28a1237d517489d5e053.exe
Resource
win7-20240215-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.olne.gr - Port:
587 - Username:
[email protected] - Password:
dia123A@ - Email To:
[email protected]
Targets
-
-
Target
401c290929faf18ea2fe4696eb2a9e971c2bdf980f3f28a1237d517489d5e053
-
Size
661KB
-
MD5
601db4b94f8097f72d75b7beb086b933
-
SHA1
ec4c8e8cd2a4168cd0fb7cdb9cfcbf3384b38f2c
-
SHA256
401c290929faf18ea2fe4696eb2a9e971c2bdf980f3f28a1237d517489d5e053
-
SHA512
312f7ec9e54c6df101afb58a3f786304af6d81d956dd0f0c645767be7e5de39a284210abb0663431bbd9ee651418627ab259210093aa16d16001c46aed99e67e
-
SSDEEP
12288:Btkvq31eoWJbvukj3JjYC6RXstUBtWFF97SGi+beSgXtnuAgk7H:BteqF0zukdjqRcn2FLXluAge
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-