General
-
Target
8c48688d795f1ff90fa87b1eafd94190518e4a850f5a9aa265350158c85cbc62.exe
-
Size
77.0MB
-
Sample
241008-paa9xawcjn
-
MD5
a441db009e52a518a60acf292302f8b9
-
SHA1
7b074fd716dad974e147dee21566d37878c909f4
-
SHA256
8c48688d795f1ff90fa87b1eafd94190518e4a850f5a9aa265350158c85cbc62
-
SHA512
4b1814074434ee593d60de8f1218c4ae465c23973f60d76ee158fe1462c25096efb6fe8a93466e1d8f05f377626d481c89a9d2fff250df4d4307ce93ac306658
-
SSDEEP
24576:uRmJkcoQricOIQxiZY1iaCDQIvkMmTJ0QAJxGboPIf:7JZoQrbTFZY1iaCDNvkMbdJioPI
Static task
static1
Behavioral task
behavioral1
Sample
8c48688d795f1ff90fa87b1eafd94190518e4a850f5a9aa265350158c85cbc62.exe
Resource
win7-20240729-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.flujoauditorias.cl - Port:
587 - Username:
[email protected] - Password:
l;0jGu7J;z_a
Extracted
agenttesla
Protocol: smtp- Host:
mail.flujoauditorias.cl - Port:
587 - Username:
[email protected] - Password:
l;0jGu7J;z_a - Email To:
[email protected]
Targets
-
-
Target
8c48688d795f1ff90fa87b1eafd94190518e4a850f5a9aa265350158c85cbc62.exe
-
Size
77.0MB
-
MD5
a441db009e52a518a60acf292302f8b9
-
SHA1
7b074fd716dad974e147dee21566d37878c909f4
-
SHA256
8c48688d795f1ff90fa87b1eafd94190518e4a850f5a9aa265350158c85cbc62
-
SHA512
4b1814074434ee593d60de8f1218c4ae465c23973f60d76ee158fe1462c25096efb6fe8a93466e1d8f05f377626d481c89a9d2fff250df4d4307ce93ac306658
-
SSDEEP
24576:uRmJkcoQricOIQxiZY1iaCDQIvkMmTJ0QAJxGboPIf:7JZoQrbTFZY1iaCDNvkMbdJioPI
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-