General
-
Target
3092605445c3acdf8d63cc7db1924b8ff09f039c1c427dd5aed008c37b9d5575.exe
-
Size
864KB
-
Sample
221204-qbf28abe39
-
MD5
62743a9c1c8921f4d0004c73802b12a5
-
SHA1
751dc4baf8c4ae5b219807935349ece9a322d307
-
SHA256
3092605445c3acdf8d63cc7db1924b8ff09f039c1c427dd5aed008c37b9d5575
-
SHA512
f304ae02c14954b5acd45290f704e6919ee9e14bd98742c4050e3bb0db0895a50856e8dba5480ede2ce6b6d5084e6ca8474f22e3fcfeb1add02f424eb9624489
-
SSDEEP
12288:jop/2zEJPE39sMqmqpFr5cE8LHW1IIfTv9eolLsXwVkp0eOVNdOQBJ/SEdRMA/Lr:joxZjmqGvLM/xpVk+dV9/L1t0In
Static task
static1
Behavioral task
behavioral1
Sample
3092605445c3acdf8d63cc7db1924b8ff09f039c1c427dd5aed008c37b9d5575.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3092605445c3acdf8d63cc7db1924b8ff09f039c1c427dd5aed008c37b9d5575.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5745656562:AAEWafwrgUiORYk4Z5mN1SY726IYW3inkfw/
Targets
-
-
Target
3092605445c3acdf8d63cc7db1924b8ff09f039c1c427dd5aed008c37b9d5575.exe
-
Size
864KB
-
MD5
62743a9c1c8921f4d0004c73802b12a5
-
SHA1
751dc4baf8c4ae5b219807935349ece9a322d307
-
SHA256
3092605445c3acdf8d63cc7db1924b8ff09f039c1c427dd5aed008c37b9d5575
-
SHA512
f304ae02c14954b5acd45290f704e6919ee9e14bd98742c4050e3bb0db0895a50856e8dba5480ede2ce6b6d5084e6ca8474f22e3fcfeb1add02f424eb9624489
-
SSDEEP
12288:jop/2zEJPE39sMqmqpFr5cE8LHW1IIfTv9eolLsXwVkp0eOVNdOQBJ/SEdRMA/Lr:joxZjmqGvLM/xpVk+dV9/L1t0In
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-