General
-
Target
2eeec947de3dee177c0a5ff2727e98953d0285f174b43074fee0a6e909c1593a
-
Size
871B
-
Sample
240710-hc4kxavakb
-
MD5
97e836763af67b1b0e00252408a39a88
-
SHA1
d935c780543731e23aa7f3ceae8cae28edc5a9a5
-
SHA256
a4260a4f5f90ed89b3eb92927000cddc404942edd36471de656972e73e694b01
-
SHA512
6bf61e443fc8c8d7ffcdee9d0b0a9cf7e2c9e157a65749787380f5aeac5c8fb4d232ffcd17708e38784a0626c2eaabbf5eabedc3ef240e8f2a1833ce1dfe5f66
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
bizr usjt guapiims
Extracted
agenttesla
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
bizr usjt guapiims - Email To:
[email protected]
Targets
-
-
Target
2eeec947de3dee177c0a5ff2727e98953d0285f174b43074fee0a6e909c1593a
-
Size
7KB
-
MD5
bc80530079fd263dd26e267d797cd4ad
-
SHA1
54215542d4c17815915c2aa3efe76605b394092f
-
SHA256
2eeec947de3dee177c0a5ff2727e98953d0285f174b43074fee0a6e909c1593a
-
SHA512
64799c7cd10dff4c002f7ac77db485593d13b6f79a983e9b7c785e8a411958b10238daae69f8549e52977413eb0226070448f7813283780563bd493afc7b8580
-
SSDEEP
192:tIiianBNVi8xF1wG1FbIPieeRXtXqHUUN7i592E:tIiianBNVi8n1wG1FbIPieeRXtXqHUUW
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-