General
-
Target
aab3b5e870161ccd2363308759569ab4665f30556b9315a20308324f5980006a
-
Size
1.1MB
-
Sample
240727-bjndyaxapj
-
MD5
72cb4446ad3b4de6f58f4eb022272b56
-
SHA1
03459a7e5bed6238cb97b93ffac53787761a598f
-
SHA256
aab3b5e870161ccd2363308759569ab4665f30556b9315a20308324f5980006a
-
SHA512
232f74bd308ee4e4053fe7acead77e9f5c18ed5ee4fe1b1224bb981663a3203d3b33fb9551162a7b93c237fed1d16418da1c7c86aa1ef054edec156c119406e1
-
SSDEEP
24576:FqDEvCTbMWu7rQYlBQcBiT6rprG8aFVEToLhmLHJH/:FTvC/MTQYxsWR7aFVZhq
Static task
static1
Behavioral task
behavioral1
Sample
aab3b5e870161ccd2363308759569ab4665f30556b9315a20308324f5980006a.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
aab3b5e870161ccd2363308759569ab4665f30556b9315a20308324f5980006a.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.santonswitchgears.com - Port:
587 - Username:
[email protected] - Password:
cJPF@$I3 - Email To:
[email protected]
Targets
-
-
Target
aab3b5e870161ccd2363308759569ab4665f30556b9315a20308324f5980006a
-
Size
1.1MB
-
MD5
72cb4446ad3b4de6f58f4eb022272b56
-
SHA1
03459a7e5bed6238cb97b93ffac53787761a598f
-
SHA256
aab3b5e870161ccd2363308759569ab4665f30556b9315a20308324f5980006a
-
SHA512
232f74bd308ee4e4053fe7acead77e9f5c18ed5ee4fe1b1224bb981663a3203d3b33fb9551162a7b93c237fed1d16418da1c7c86aa1ef054edec156c119406e1
-
SSDEEP
24576:FqDEvCTbMWu7rQYlBQcBiT6rprG8aFVEToLhmLHJH/:FTvC/MTQYxsWR7aFVZhq
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-