General
-
Target
4e1b00dd1374c6d922e8a141562bbf88f69961e3034a6158007cf2ced5c31c62.exe
-
Size
1.1MB
-
Sample
240618-vfsc9ssbld
-
MD5
d59340afee53c8e993c22afe7ac53800
-
SHA1
59ac48c3c98d5cd67f411c556b97d116b4b4660a
-
SHA256
4e1b00dd1374c6d922e8a141562bbf88f69961e3034a6158007cf2ced5c31c62
-
SHA512
d12249d36ee81ca1f39083d4c981735acf81ba1b91b4a2dae85e33ac0ce74fc3c971f118ce1d5baac47cb2336134fc668c54b7159b3e3b36047299b7c1602318
-
SSDEEP
24576:vAHnh+eWsN3skA4RV1Hom2KXMmHaRdZTKdv6lbB7/p5:Sh+ZkldoPK8YaRStMbV
Static task
static1
Behavioral task
behavioral1
Sample
4e1b00dd1374c6d922e8a141562bbf88f69961e3034a6158007cf2ced5c31c62.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4e1b00dd1374c6d922e8a141562bbf88f69961e3034a6158007cf2ced5c31c62.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.controlfire.com.mx - Port:
587 - Username:
[email protected] - Password:
+DI9CNZM&Y%W - Email To:
[email protected]
Targets
-
-
Target
4e1b00dd1374c6d922e8a141562bbf88f69961e3034a6158007cf2ced5c31c62.exe
-
Size
1.1MB
-
MD5
d59340afee53c8e993c22afe7ac53800
-
SHA1
59ac48c3c98d5cd67f411c556b97d116b4b4660a
-
SHA256
4e1b00dd1374c6d922e8a141562bbf88f69961e3034a6158007cf2ced5c31c62
-
SHA512
d12249d36ee81ca1f39083d4c981735acf81ba1b91b4a2dae85e33ac0ce74fc3c971f118ce1d5baac47cb2336134fc668c54b7159b3e3b36047299b7c1602318
-
SSDEEP
24576:vAHnh+eWsN3skA4RV1Hom2KXMmHaRdZTKdv6lbB7/p5:Sh+ZkldoPK8YaRStMbV
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-