General
-
Target
4a0df85f8524e068355662a6ad8cbc1312a468c68c30af0be14ab3a7ef3429b5
-
Size
880KB
-
Sample
250123-brxbtavpaw
-
MD5
24aeb260eca7526236631f38c3cde609
-
SHA1
4373ea336a9cf9470a99a8406b0267b455d19ef8
-
SHA256
4a0df85f8524e068355662a6ad8cbc1312a468c68c30af0be14ab3a7ef3429b5
-
SHA512
5295cbb613faeaabc64b010c87a846337b5a9de3c612fb7c8103cfe078d3dfb77a0f7290a41ad8d285b5675fa87b984a2946ecdc1d5a5e4af92fd8b4187671b8
-
SSDEEP
24576:6+i+dSv2TvjxdYqBS0My8UlYGYNK9X5i88+QmZQ:6+7dUU/xSpdUKGYNewj+Qd
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
w#chNV#1 - Email To:
[email protected]
Targets
-
-
Target
New POs# ST-2312180 to ST-2312182.exe
-
Size
1.3MB
-
MD5
b30d2c0c5d2a7eb1d14fcbee93a3dfb5
-
SHA1
03a916e21638160bcc2c60a223ea6effbafbe9b6
-
SHA256
3548aa0ee0cecf920604b5d5d5c231f2a5241a012548198402e6121a43ef55f7
-
SHA512
8edcef9ba3e7c0220edc57aedb42a916298da358b76a278321b055897f5f709a88ecdf850894e1f6afe0febdf4fbecc637c39c75b064b7ca94cf01988136bf71
-
SSDEEP
24576:xtb20pkaCqT5TBWgNQ7aKq1LnckdvRHADmacmzi/rYApm6A:CVg5tQ7aK45OSB+is5
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-