General
-
Target
d21bdb41cbc3370a43458cb6002a0b1a7d1916fc1b5867c87f68d224b6a1555c
-
Size
683KB
-
Sample
241115-cf2ylawlhx
-
MD5
c75e23e42ef5a5df0c9e6a3dac5b6288
-
SHA1
7893b4c8af41995dd0ec3b29ef64c1ceb9df1d6d
-
SHA256
d21bdb41cbc3370a43458cb6002a0b1a7d1916fc1b5867c87f68d224b6a1555c
-
SHA512
cf3ba709924ccfca0c936b28020e44250a82d0c6965960358399826d0f473ba2c5bed027cb5e5ee81b311fd47ae09373089b63056b98de3a533d663f053fd399
-
SSDEEP
12288:0IipgFGd/w3uEjlcsl5WcP6oEfsB206JSE6Mfo+zli:0IPy1ZsqcO8TDMfB
Static task
static1
Behavioral task
behavioral1
Sample
d21bdb41cbc3370a43458cb6002a0b1a7d1916fc1b5867c87f68d224b6a1555c.exe
Resource
win7-20240903-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
graceofgod@amen - Email To:
[email protected]
Targets
-
-
Target
d21bdb41cbc3370a43458cb6002a0b1a7d1916fc1b5867c87f68d224b6a1555c
-
Size
683KB
-
MD5
c75e23e42ef5a5df0c9e6a3dac5b6288
-
SHA1
7893b4c8af41995dd0ec3b29ef64c1ceb9df1d6d
-
SHA256
d21bdb41cbc3370a43458cb6002a0b1a7d1916fc1b5867c87f68d224b6a1555c
-
SHA512
cf3ba709924ccfca0c936b28020e44250a82d0c6965960358399826d0f473ba2c5bed027cb5e5ee81b311fd47ae09373089b63056b98de3a533d663f053fd399
-
SSDEEP
12288:0IipgFGd/w3uEjlcsl5WcP6oEfsB206JSE6Mfo+zli:0IPy1ZsqcO8TDMfB
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-