General
-
Target
74737b9305b3aa92267c16466bc8071e429b1c66b24091bcf32d37a9ae58f92a
-
Size
1.1MB
-
Sample
241122-bll9naxlgq
-
MD5
6b4078015f09d434b81b9dccdf39a870
-
SHA1
6c06e16cb1558f27a3a7d2e6726cafaf59fb8e67
-
SHA256
74737b9305b3aa92267c16466bc8071e429b1c66b24091bcf32d37a9ae58f92a
-
SHA512
ed960cc1c3f9288a327741380f57e05cedbe0e406423977db13fe24872c1efc3e6e9bd4a23194a601ca1c5e9d4bb1c5e36591aedd5cd5c088b010cee999d6963
-
SSDEEP
24576:IO2j8/LL5X8jGW8Ii+oAZbY0xplJaHYTVQZPPIF:j2j8PgBxoAS0BJIw2P
Static task
static1
Behavioral task
behavioral1
Sample
74737b9305b3aa92267c16466bc8071e429b1c66b24091bcf32d37a9ae58f92a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
74737b9305b3aa92267c16466bc8071e429b1c66b24091bcf32d37a9ae58f92a.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.focuzpartsmart.com - Port:
587 - Username:
[email protected] - Password:
FpmJhn@2023 - Email To:
[email protected]
Targets
-
-
Target
74737b9305b3aa92267c16466bc8071e429b1c66b24091bcf32d37a9ae58f92a
-
Size
1.1MB
-
MD5
6b4078015f09d434b81b9dccdf39a870
-
SHA1
6c06e16cb1558f27a3a7d2e6726cafaf59fb8e67
-
SHA256
74737b9305b3aa92267c16466bc8071e429b1c66b24091bcf32d37a9ae58f92a
-
SHA512
ed960cc1c3f9288a327741380f57e05cedbe0e406423977db13fe24872c1efc3e6e9bd4a23194a601ca1c5e9d4bb1c5e36591aedd5cd5c088b010cee999d6963
-
SSDEEP
24576:IO2j8/LL5X8jGW8Ii+oAZbY0xplJaHYTVQZPPIF:j2j8PgBxoAS0BJIw2P
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1