General
-
Target
958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa
-
Size
896KB
-
Sample
240428-blqbbada7t
-
MD5
772e33e3128cd815827b68962d35a707
-
SHA1
de800a3bc8498bd6dda93461d5119400c3517d6f
-
SHA256
958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa
-
SHA512
c6e2d9f85fc4d3b4891717daf15709ddf6f275b04126718c75fe2c13c03896d30bcdcb5e56c22a2adfacf5da46a7e9ae3fbb8b34d56d677c280dafb4d6849a30
-
SSDEEP
12288:3oqnHvjNIrpf9rN/mc/CUCwYcg+5kn4CQga5ZDnFdYJzadBL/JqI3eAe4Qvrpm86:3lPjKr5BNDlkn4oaDD/YJmF5Qz0bCK
Static task
static1
Behavioral task
behavioral1
Sample
958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6491123377:AAHfZF2lTXFg1xxaNDsPtoz_ltH2gj_Gldk/
Targets
-
-
Target
958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa
-
Size
896KB
-
MD5
772e33e3128cd815827b68962d35a707
-
SHA1
de800a3bc8498bd6dda93461d5119400c3517d6f
-
SHA256
958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa
-
SHA512
c6e2d9f85fc4d3b4891717daf15709ddf6f275b04126718c75fe2c13c03896d30bcdcb5e56c22a2adfacf5da46a7e9ae3fbb8b34d56d677c280dafb4d6849a30
-
SSDEEP
12288:3oqnHvjNIrpf9rN/mc/CUCwYcg+5kn4CQga5ZDnFdYJzadBL/JqI3eAe4Qvrpm86:3lPjKr5BNDlkn4oaDD/YJmF5Qz0bCK
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-