General
-
Target
LPO.js
-
Size
133KB
-
Sample
241010-c9f8zsvhrd
-
MD5
de1ff5796636ce90ae34773c2492714f
-
SHA1
a737641923b33bb911f22e8da3bc98849737cd10
-
SHA256
18d1b246a29100b10a3ce587927ebb0c615156352598621da18250f8ad06e318
-
SHA512
e0d4ec7ebce60d0eba1c61db69090144864c7da89f7968a2d4de1c169e661717c5f1f8534fd435a674374f6453278dfa67b11ebb6dd585e4a1daf5071da8f39d
-
SSDEEP
3072:FLGoPD/IMIFiLTJIdmX/ZJYTaLGoPD/IM+:lQMIehmTcQM+
Malware Config
Extracted
https://ia600101.us.archive.org/1/items/detah-note-j_202410/DetahNote_J.jpg%20
https://ia600101.us.archive.org/1/items/detah-note-j_202410/DetahNote_J.jpg%20
Extracted
Protocol: smtp- Host:
mail.ctdi.com.ph - Port:
587 - Username:
[email protected] - Password:
A#f+Y]H8iO4a
Extracted
agenttesla
Protocol: smtp- Host:
mail.ctdi.com.ph - Port:
587 - Username:
[email protected] - Password:
A#f+Y]H8iO4a - Email To:
[email protected]
Targets
-
-
Target
LPO.js
-
Size
133KB
-
MD5
de1ff5796636ce90ae34773c2492714f
-
SHA1
a737641923b33bb911f22e8da3bc98849737cd10
-
SHA256
18d1b246a29100b10a3ce587927ebb0c615156352598621da18250f8ad06e318
-
SHA512
e0d4ec7ebce60d0eba1c61db69090144864c7da89f7968a2d4de1c169e661717c5f1f8534fd435a674374f6453278dfa67b11ebb6dd585e4a1daf5071da8f39d
-
SSDEEP
3072:FLGoPD/IMIFiLTJIdmX/ZJYTaLGoPD/IM+:lQMIehmTcQM+
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-