General
-
Target
51037ce1389daacda6c8f50f8830a7c7517f774e8041a9e4d74d184b50428952.exe
-
Size
769KB
-
Sample
241115-tr2weaxcre
-
MD5
2816433f12d4e071e38bb42d6d2fc723
-
SHA1
5934cb7f1d9dd721973bc05199cdb0c341b79bef
-
SHA256
51037ce1389daacda6c8f50f8830a7c7517f774e8041a9e4d74d184b50428952
-
SHA512
c46660c5322eb1f815dd5b3f535e2afc0a5e98bff1d5c6cbc55c60d2587a79f6d692b3e40e590c6efad56ac72fdbe6eb89199b1a8dd57702c6d78d1f6466ed8c
-
SSDEEP
12288:5W3lK5SX0mH7zCJVMMEpWREG79erWZJP+43as57S6QCWcxxojN/ze6l159j+ukp:EzCJVbBEGRerUJd576CWciUc9j+N
Static task
static1
Behavioral task
behavioral1
Sample
51037ce1389daacda6c8f50f8830a7c7517f774e8041a9e4d74d184b50428952.exe
Resource
win7-20240903-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
zqamcx.com - Port:
587 - Username:
[email protected] - Password:
Methodman991 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
zqamcx.com - Port:
587 - Username:
[email protected] - Password:
Methodman991
Targets
-
-
Target
51037ce1389daacda6c8f50f8830a7c7517f774e8041a9e4d74d184b50428952.exe
-
Size
769KB
-
MD5
2816433f12d4e071e38bb42d6d2fc723
-
SHA1
5934cb7f1d9dd721973bc05199cdb0c341b79bef
-
SHA256
51037ce1389daacda6c8f50f8830a7c7517f774e8041a9e4d74d184b50428952
-
SHA512
c46660c5322eb1f815dd5b3f535e2afc0a5e98bff1d5c6cbc55c60d2587a79f6d692b3e40e590c6efad56ac72fdbe6eb89199b1a8dd57702c6d78d1f6466ed8c
-
SSDEEP
12288:5W3lK5SX0mH7zCJVMMEpWREG79erWZJP+43as57S6QCWcxxojN/ze6l159j+ukp:EzCJVbBEGRerUJd576CWciUc9j+N
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1