General
-
Target
agent.zip
-
Size
701KB
-
Sample
241015-1l1vgsshll
-
MD5
3e0fb4a939d079e5fd90a018724504ca
-
SHA1
77cf27764c23560e3a99abdf08c522f6b1744d07
-
SHA256
d26535f5ff8c3f3d83cd09bfb026f9f3fba2da4c0e3bf06f80550bb632bc9f73
-
SHA512
310b2593961ce09e9b52c409265d7b44d632394deacfda001c75413fe3708d5b65cb4a4898abfa4c2faebd10d770e4d560440ce12a858e676a3641ba36df7c4b
-
SSDEEP
12288:gBLsOJuBvcrKkiTd9kh9UHgc0vt0xDZOIQm/zWTZMxAiP844Sh6IiH1j1mlg+Kdm:CKA/iPkh9UsyHQlni5qH1jQlHojOT
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.lavli.rs - Port:
587 - Username:
[email protected] - Password:
lavlirsinfo2010 - Email To:
[email protected]
Targets
-
-
Target
a6ae703da8eab0f1d26f7819d16202a17a000c342c4b3dc0cd11d535b5b50511
-
Size
915KB
-
MD5
2b8caa685c7fc7b1d39fa3eeee7c15a5
-
SHA1
faa007566a0aa7c89155a2153545af43c073651d
-
SHA256
a6ae703da8eab0f1d26f7819d16202a17a000c342c4b3dc0cd11d535b5b50511
-
SHA512
b85f5dac1d974c424ddf49982dc05acb85b1ce8c75d9b4cdb1a631b92beb55fe9046424e15b201a0f3f7bd0305df2599284115e4368508b2b155b13b62e6dad1
-
SSDEEP
24576:00NwSIOU6QJKm4+a1qalZdvf6mNdxF3NxwZpzjo:hySO67Pqa5vdSpzs
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-