General
-
Target
SecuriteInfo.com.Win32.RATX-gen.6711.1335.exe
-
Size
1.1MB
-
Sample
221125-jd4gzabc38
-
MD5
f93e56f59bcb14ced89778ca311ed51e
-
SHA1
fbd38393b171712b0b944e512f92e9778d884f10
-
SHA256
b3735e53d6bd12bc0dad5af1f6e67a6edf728f45cddbeb1d3ea0caf09c16fe04
-
SHA512
4e1de2523c09e929bdff3815f7da4c9df28bb968bb145d7eefb556ac8689e60e81984346c352af6d180a28f86e66379c65e383d13be038bed31bd9608e7a985b
-
SSDEEP
24576:/SR22mYaeMGimDjaDluNDGEJ/CJE+q4Nd+K3MfAeRD5LnEU:/atYGioeDOjJCys80eFJE
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.RATX-gen.6711.1335.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.RATX-gen.6711.1335.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1897716112:AAEAtOCkOV8umHBB93Og24bkiIdUKReGK44/
Targets
-
-
Target
SecuriteInfo.com.Win32.RATX-gen.6711.1335.exe
-
Size
1.1MB
-
MD5
f93e56f59bcb14ced89778ca311ed51e
-
SHA1
fbd38393b171712b0b944e512f92e9778d884f10
-
SHA256
b3735e53d6bd12bc0dad5af1f6e67a6edf728f45cddbeb1d3ea0caf09c16fe04
-
SHA512
4e1de2523c09e929bdff3815f7da4c9df28bb968bb145d7eefb556ac8689e60e81984346c352af6d180a28f86e66379c65e383d13be038bed31bd9608e7a985b
-
SSDEEP
24576:/SR22mYaeMGimDjaDluNDGEJ/CJE+q4Nd+K3MfAeRD5LnEU:/atYGioeDOjJCys80eFJE
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-