General
-
Target
c191d4268f7f39aaeec5069c2e7431b76091ecbc77b527df069504c1ea50dad2.xz
-
Size
680KB
-
Sample
240705-b7a4hszbln
-
MD5
ec619aebcfcf7552165d94c1eb23e754
-
SHA1
7d52216c4675bb44bbd0dd8aedaa9c848f88302b
-
SHA256
c191d4268f7f39aaeec5069c2e7431b76091ecbc77b527df069504c1ea50dad2
-
SHA512
27f566e5ac76583d39bc6ee4a412fe68a6324d61f29508090d27c7f2c030cb87bb9d62db9ef4c1a6cac1f4f4ab05daa39d3cbe47cbe09572ab6f1638e4539a09
-
SSDEEP
12288:nt0OuFrANxq1ub2IwZ9WBMuQrpIO4904k6w22JYoKev4ynVJznHntbKqVDyTVoG:wJANxq1uqAq59hI0r22JYotQyznHnhKb
Static task
static1
Behavioral task
behavioral1
Sample
SOA Payment for June 30th.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SOA Payment for June 30th.exe
Resource
win10v2004-20240704-en
Malware Config
Extracted
Protocol: smtp- Host:
nffplp.com - Port:
587 - Username:
[email protected] - Password:
$Nke%8XIIDtm
Extracted
agenttesla
Protocol: smtp- Host:
nffplp.com - Port:
587 - Username:
[email protected] - Password:
$Nke%8XIIDtm - Email To:
[email protected]
Targets
-
-
Target
SOA Payment for June 30th.exe
-
Size
806KB
-
MD5
63128eeca6e0dabeddfd68c0517d4c91
-
SHA1
eb43eb41464d255d312b6b2aa14428ccd16156da
-
SHA256
45d0c2ec2ede02e8b8ef535346a4e7e06fd52ba27995a15a5f1a0b11e305d4f7
-
SHA512
73fabc52ee53b8ab3e70006c058ad6718b00cdc8259eccb7e545e7223d1cff7f84d670788484b6fdb59ef4930162d0ccbe83f2af4f1ab9fdc3d0577e9a767547
-
SSDEEP
12288:dLYjofC1PHG1ub2dwZEWBMlQrpNO4904kZwB2JYoUev4y1VJznHhtbKOVDyTVoy:+1m1utZqi9gI0qB2JYofQOznHhhKGy
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-