General
-
Target
0b06f6a3a4102c27376f21cbcd09d3c0bf5e6cc7e92f9b9a3810fc386ac8184d.exe
-
Size
937KB
-
Sample
241122-chvmassjg1
-
MD5
adc8d552e00251dbbdcd0aafe5bd3739
-
SHA1
bdccf1531860ea4e5c139864707332252ca6d62b
-
SHA256
0b06f6a3a4102c27376f21cbcd09d3c0bf5e6cc7e92f9b9a3810fc386ac8184d
-
SHA512
4ab5eee11aec80b2894d51f1b666461e779a012e5bb94ac536366520c2e3bd9dbd5fe40685bd522697c1db94cbb19c7612c16e9fdb855eaa35338512ef62e680
-
SSDEEP
12288:drOn+Ri3AgFdmcdsjDbxl7qu4Q0eAxpqz4A501t5z7clqO65SAvzP0zoP7r9r/+l:pQ3AgNubfqK2pqz4/5Kq3Co1q
Static task
static1
Behavioral task
behavioral1
Sample
0b06f6a3a4102c27376f21cbcd09d3c0bf5e6cc7e92f9b9a3810fc386ac8184d.exe
Resource
win7-20240903-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.iaa-airferight.com - Port:
587 - Username:
[email protected] - Password:
manlikeyou88 - Email To:
[email protected]
Targets
-
-
Target
0b06f6a3a4102c27376f21cbcd09d3c0bf5e6cc7e92f9b9a3810fc386ac8184d.exe
-
Size
937KB
-
MD5
adc8d552e00251dbbdcd0aafe5bd3739
-
SHA1
bdccf1531860ea4e5c139864707332252ca6d62b
-
SHA256
0b06f6a3a4102c27376f21cbcd09d3c0bf5e6cc7e92f9b9a3810fc386ac8184d
-
SHA512
4ab5eee11aec80b2894d51f1b666461e779a012e5bb94ac536366520c2e3bd9dbd5fe40685bd522697c1db94cbb19c7612c16e9fdb855eaa35338512ef62e680
-
SSDEEP
12288:drOn+Ri3AgFdmcdsjDbxl7qu4Q0eAxpqz4A501t5z7clqO65SAvzP0zoP7r9r/+l:pQ3AgNubfqK2pqz4/5Kq3Co1q
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1