General
-
Target
7d8a3cc2392ce50d2f75137711acb7358d30157108bfb221c509b0afbab197ec.exe
-
Size
689KB
-
Sample
240701-pk183s1fpa
-
MD5
61892612c6e00ea0df4b49338aca144f
-
SHA1
1a4a08f7cc7b24b3d47baa91a7579c06ffd24d94
-
SHA256
7d8a3cc2392ce50d2f75137711acb7358d30157108bfb221c509b0afbab197ec
-
SHA512
cf1d1719df5e78b48e1327487344b7c2aea162cfb0e1a2f0841473da67ef15a2f1f9e8f877cb11dd99ba6811e8feb6c720b45d4051c5e24524496233387250f0
-
SSDEEP
12288:9lSXz6Tl0L10G3fiOuAsqQod6peqV4xz4MhNsgqZ5ntjOs:iuS10EsqHpq6xz4Mh4Z5j
Static task
static1
Behavioral task
behavioral1
Sample
7d8a3cc2392ce50d2f75137711acb7358d30157108bfb221c509b0afbab197ec.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
7d8a3cc2392ce50d2f75137711acb7358d30157108bfb221c509b0afbab197ec.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.fvpumps.com - Port:
587 - Username:
[email protected] - Password:
%Babt$D4 - Email To:
[email protected]
Targets
-
-
Target
7d8a3cc2392ce50d2f75137711acb7358d30157108bfb221c509b0afbab197ec.exe
-
Size
689KB
-
MD5
61892612c6e00ea0df4b49338aca144f
-
SHA1
1a4a08f7cc7b24b3d47baa91a7579c06ffd24d94
-
SHA256
7d8a3cc2392ce50d2f75137711acb7358d30157108bfb221c509b0afbab197ec
-
SHA512
cf1d1719df5e78b48e1327487344b7c2aea162cfb0e1a2f0841473da67ef15a2f1f9e8f877cb11dd99ba6811e8feb6c720b45d4051c5e24524496233387250f0
-
SSDEEP
12288:9lSXz6Tl0L10G3fiOuAsqQod6peqV4xz4MhNsgqZ5ntjOs:iuS10EsqHpq6xz4Mh4Z5j
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-