General
-
Target
d0b87063b6650eae50562ac215cd7ccf80d9b8dbd53b6c11e5306894c83766ff
-
Size
1.1MB
-
Sample
250115-bsw3faxrgr
-
MD5
801c05bc6d85a38cb25d022ec645afda
-
SHA1
8d0b1fd88c713446e0e3a2d73fd19ea9dfdc02a5
-
SHA256
d0b87063b6650eae50562ac215cd7ccf80d9b8dbd53b6c11e5306894c83766ff
-
SHA512
7a27d2f080cff3f90e5f65213a377ff45e54b3067f9657649314ffb1172a4110cf627c326956b9745e8ba3f69aef180fd158060422fbf1d350a354d11025a21e
-
SSDEEP
24576:hhzMP9E9TRthv8t/EtsIaqvec0fEch5oegyaR:hhzMP96ni/EIqvzMq6aR
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.iaa-airferight.com - Port:
587 - Username:
[email protected] - Password:
webmaster - Email To:
[email protected]
Targets
-
-
Target
new order 457746748.exe
-
Size
1.3MB
-
MD5
a60ae5b2b27754008e1197e87104453f
-
SHA1
76cc8d0d1ce43796af3290937470b446fa918aa5
-
SHA256
95fb84d1006d06bef8ead6bcc95a19abb112a16c2f6bd6e2ac2b9df30246364d
-
SHA512
8c4dd8a8dd1196c6b6d322f1bd94737c264fe6a25cc28e1f65e9d189a13c6e74a177618a3a8e1dc81afbef79ab18c86cd91b1c0cd403c9c064587fb93cd6bef3
-
SSDEEP
24576:Ho62WQve2q4HUX/QPJj50KSwLxsn6ZmZjMifKX5M7ws43nJxx1q4:jltuk8in6ZmZjrKX5M8Xi4
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Drops startup file
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-