General
-
Target
44982180a2b2da0d098ed9f5a932a38bdd7d0429229510db7296993cf26ed676
-
Size
597KB
-
Sample
241220-bhz2cavpcv
-
MD5
a7b5c2693e1fc288c362703f349328a9
-
SHA1
7d0528eea1bfca3a321e5af0d0a61f99659bdc89
-
SHA256
44982180a2b2da0d098ed9f5a932a38bdd7d0429229510db7296993cf26ed676
-
SHA512
90572edbdbc61e0e6c6d8272899b8301f3440247974c2a5cb41a9b11c60838e2230ce88a3c2c4ce9fc34bab23bc04fee24abd27eeb867481c777cc1b0408a5b1
-
SSDEEP
12288:pV/R2pizgq7C329bvf+pn8KLCNlbmsoe/2+l6FrYqznRuYo+jUw:z/Rmizgq6UGvLimsovdFrY9yUw
Static task
static1
Behavioral task
behavioral1
Sample
SKM_5890525167809.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SKM_5890525167809.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.alltoursegypt.com - Port:
587 - Username:
[email protected] - Password:
OPldome23#12klein
Extracted
agenttesla
Protocol: smtp- Host:
mail.alltoursegypt.com - Port:
587 - Username:
[email protected] - Password:
OPldome23#12klein - Email To:
[email protected]
Targets
-
-
Target
SKM_5890525167809.exe
-
Size
1.1MB
-
MD5
d1642b4a6a94d085fabfd70a2ac37deb
-
SHA1
6c00daa9f86d1afcdfdb47cf3a4555eb242d5d21
-
SHA256
0c7fc6fd424661d954ddf30325f8c98aed5b144cdf24a4197225d691be16f730
-
SHA512
5d2e5645c943cc729a1daf24147a67334df9cdfddd90c693d5be606db255bfc131b4ddac6851e76404f0a0e32d8dc7417ee0521838fc81c72e562b413bc0f696
-
SSDEEP
24576:OqDEvCTbMWu7rQYlBQcBiT6rprG8ag4mjRxL:OTvC/MTQYxsWR7agp9x
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-