General
-
Target
80fab172a96913484d5ed2c9c52c618f2d7f977e671971746c31fe44e3d82337
-
Size
630KB
-
Sample
240620-ccqfdswhpk
-
MD5
1252bc0b2bdc45d2e888d0e191c219a3
-
SHA1
102bfccfcec20493e6192f0416325af9ec3b152b
-
SHA256
80fab172a96913484d5ed2c9c52c618f2d7f977e671971746c31fe44e3d82337
-
SHA512
7fe6d69971b82258c3310bd34e0fff25a0646fb85c684b23cdd23e049298088965ebadc5a1c9001d42cf5bd77e562de8363cdaf4a602fb36fc20cdf1632c90a6
-
SSDEEP
12288:5H2l3LVl0kUZ0VaqIGf7q0qASJQH1Wz42zJvKQ29EdoPK4ENzkK:MLkkk0kq5G0rWQKdKQ9doZEN
Static task
static1
Behavioral task
behavioral1
Sample
80fab172a96913484d5ed2c9c52c618f2d7f977e671971746c31fe44e3d82337.exe
Resource
win7-20240508-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
outlook.office365.com - Port:
587 - Username:
[email protected] - Password:
Nou133787064 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
outlook.office365.com - Port:
587 - Username:
[email protected] - Password:
Nou133787064
Targets
-
-
Target
80fab172a96913484d5ed2c9c52c618f2d7f977e671971746c31fe44e3d82337
-
Size
630KB
-
MD5
1252bc0b2bdc45d2e888d0e191c219a3
-
SHA1
102bfccfcec20493e6192f0416325af9ec3b152b
-
SHA256
80fab172a96913484d5ed2c9c52c618f2d7f977e671971746c31fe44e3d82337
-
SHA512
7fe6d69971b82258c3310bd34e0fff25a0646fb85c684b23cdd23e049298088965ebadc5a1c9001d42cf5bd77e562de8363cdaf4a602fb36fc20cdf1632c90a6
-
SSDEEP
12288:5H2l3LVl0kUZ0VaqIGf7q0qASJQH1Wz42zJvKQ29EdoPK4ENzkK:MLkkk0kq5G0rWQKdKQ9doZEN
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-