General
-
Target
b3346c3b5d62f4187ce42618ea536748e3903dc1917da2a583ddb3567c748f8b.z
-
Size
4KB
-
Sample
241017-cnqkjaxbkh
-
MD5
aa05c1115a21cc40aa83cc6f7f2508aa
-
SHA1
193f501607ee962419522d662be9391a84d94920
-
SHA256
b3346c3b5d62f4187ce42618ea536748e3903dc1917da2a583ddb3567c748f8b
-
SHA512
aa6039f4efea958a10a218749635e142e5d3b986483e08e369f516ce14957ff4e386d6dae1a661851f53184fad9df14672ff7990873d980fc6b129d888ab8629
-
SSDEEP
96:KhhD0j6Ko4n0KFEq18jWLUwdzkD4XX/m23L9i67LtG0Qnmc+L1go:KruFp0K2i8aLSERf/tGtnmt
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.al-subai.com - Port:
587 - Username:
[email protected] - Password:
information12 - Email To:
[email protected]
Targets
-
-
Target
RFQ-KTE-16102024.cmd
-
Size
9KB
-
MD5
b08b254246c5983af5cfe0518d93dd44
-
SHA1
2ceddce73d6c3d7db3bf4691df150dfc15506219
-
SHA256
6c7369db06060c270fb78b99ab9a6bdba2f01c63f1ec658dd49fbcfc320be3b4
-
SHA512
e7e2ba12ca4dca27c02e205c2bb8e4617f216c1b89686404154386594623e316661b2c322340dc59b2f539bf8bb72cec3756923308639a7f0253de2e10570014
-
SSDEEP
192:eNHj0XTlm+ePA07Jv+aWa431e5NryYN5JyJ:uHUTQ+697Jv+na43kN2h
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-