General
-
Target
cabc9839ffae3cb2a8d429f37db6fc990761adab7ae2a4e9566b2f7fa22e4ef3
-
Size
21KB
-
Sample
250120-hjq86awqc1
-
MD5
b08ebb2727dc390be5aa2e453bd6466c
-
SHA1
6746886e294e9ca0a17dfaa36f618c31b9bdd61a
-
SHA256
cabc9839ffae3cb2a8d429f37db6fc990761adab7ae2a4e9566b2f7fa22e4ef3
-
SHA512
9f21194a2b057d077214977e72f79f11f60ec23ca9fa594038de517509ee145d5669500f564f07b78434dc664cfcd27aaf7b72b2f3598e768a379c0e9c73fb32
-
SSDEEP
384:fMz41pECzdgEXzsvG/Cxou8ZzSlNitDLlhwY5bXphh:pECzPAjRNiJLlF5b9
Malware Config
Extracted
https://ia600805.us.archive.org/10/items/new_image_202501/new_image.jpg%20
https://ia600805.us.archive.org/10/items/new_image_202501/new_image.jpg%20
Extracted
Protocol: smtp- Host:
mail.ctdi.com.ph - Port:
587 - Username:
[email protected] - Password:
A#f+Y]H8iO4a
Extracted
agenttesla
Protocol: smtp- Host:
mail.ctdi.com.ph - Port:
587 - Username:
[email protected] - Password:
A#f+Y]H8iO4a - Email To:
[email protected]
Targets
-
-
Target
20250120.js
-
Size
73KB
-
MD5
3c59d737f35d68bbe2e3b439f5b2721e
-
SHA1
348a45200e40b92d6568dfbd84645da895d071e2
-
SHA256
7a9213f8719cf4d04d44e17846fd121c58a3f6d4bf1ffe834836c8ae746b248b
-
SHA512
0b73c8d15fda1e90e7a892c33716e0393ca51a24d404a1ba2146988d2dcab7b9889fd331ca8a1644d6e299d80f3dfb29079ebfc6bce7ac409105d4e7473f84c5
-
SSDEEP
1536:0Q4izQ6VsYW/t5JKtxG+B5jIWiHKHmdcAEGM6vax:0OzQ6Vi/vdPk
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-