General
-
Target
6050d3cacd8e928029dabec97d6584336462f26d2439e26fb4f4fd52dc26f8a0
-
Size
728KB
-
Sample
240916-q91vaa1dmc
-
MD5
d28662586708ec3dd64627b5a0b37aeb
-
SHA1
d15b924141703af4c2fd87b8cd2950b817e1c4f6
-
SHA256
6050d3cacd8e928029dabec97d6584336462f26d2439e26fb4f4fd52dc26f8a0
-
SHA512
49ac76acb95ee4e56c11bce8682ee4e47b4972a05af778ee90239f808ef3451be530da10f21348795dbbfdf65884fa31140e6924273030ea606819c3833ab4b6
-
SSDEEP
12288:o+BnbU7Oml2v/hmHNWTCEwWk8kXeRZaSvHUHJ2uX5REOWk4Tw9HEgXqn8OrsP49B:3BbUimlGhmHNIwWk8kXeTNvHU8O5RIkG
Static task
static1
Behavioral task
behavioral1
Sample
3db464cfb18f44f0bd814e59789a76363c0db090afd595add448f8ca802284e2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3db464cfb18f44f0bd814e59789a76363c0db090afd595add448f8ca802284e2.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.flujoauditorias.cl - Port:
587 - Username:
[email protected] - Password:
l;0jGu7J;z_a
Extracted
agenttesla
Protocol: smtp- Host:
mail.flujoauditorias.cl - Port:
587 - Username:
[email protected] - Password:
l;0jGu7J;z_a - Email To:
[email protected]
Targets
-
-
Target
3db464cfb18f44f0bd814e59789a76363c0db090afd595add448f8ca802284e2.exe
-
Size
77.0MB
-
MD5
a2eb0cef8229b46e9b9a326289f9b25a
-
SHA1
ac18afedea384ff1fa3294c19fb05e20bb13966b
-
SHA256
3db464cfb18f44f0bd814e59789a76363c0db090afd595add448f8ca802284e2
-
SHA512
067f218450301f1d4b40214a42a9b85105d3c528d7056a335e043f44e756622bc1b6345a4135ebcc182516ff62414af3c73747563c5b95c8af713e0bf5a3fcc3
-
SSDEEP
24576:e4lavt0LkLL9IMixoEgea+rsiDPP/q9MmCS:Jkwkn9IMHea+zDPaPCS
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-