General
-
Target
SecuriteInfo.com.Win32.RATX-gen.9020.15864.exe
-
Size
1.1MB
-
Sample
221125-kfahcadg86
-
MD5
1ae4288b38bbac0d26b453efc7aebe84
-
SHA1
14ef625a4420d467b6d5db566d92a4fc77712e04
-
SHA256
fe0be85fab3fa5f87edc7a1fd08535e70eeeb458204577b81dc2f1eaa46543e6
-
SHA512
770737b6d2d7d1b9e1f920aa2ab7d79a2ef15e99bd2fc9d9f3eeb2be82fa35426217798bbf1383547fb5e2a1d0ef897dc6d3604f48ab7edd59ec9bf70442aa70
-
SSDEEP
24576:xQS9qEaDO84xXh82Y+c0GN/Tth2jq3y8wz85PGRF4y:KS9qi84ZBrE/T/gq3rwIsT4
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.RATX-gen.9020.15864.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.RATX-gen.9020.15864.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1840149904:AAF9D1mm8ZITxzSWfLFbRBfwFML1TyPoOMk/
Targets
-
-
Target
SecuriteInfo.com.Win32.RATX-gen.9020.15864.exe
-
Size
1.1MB
-
MD5
1ae4288b38bbac0d26b453efc7aebe84
-
SHA1
14ef625a4420d467b6d5db566d92a4fc77712e04
-
SHA256
fe0be85fab3fa5f87edc7a1fd08535e70eeeb458204577b81dc2f1eaa46543e6
-
SHA512
770737b6d2d7d1b9e1f920aa2ab7d79a2ef15e99bd2fc9d9f3eeb2be82fa35426217798bbf1383547fb5e2a1d0ef897dc6d3604f48ab7edd59ec9bf70442aa70
-
SSDEEP
24576:xQS9qEaDO84xXh82Y+c0GN/Tth2jq3y8wz85PGRF4y:KS9qi84ZBrE/T/gq3rwIsT4
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-