General
-
Target
3fae62e5822434bb1d7ec5583521a3f08e43a2521e0df922dde8ad18e666bac7.exe
-
Size
657KB
-
Sample
230330-red8gaed6t
-
MD5
e793f299a066e0ad088a6369f3c18c6b
-
SHA1
6a0ee684e49cda54351f8f737bbd7fa33a9af14d
-
SHA256
3fae62e5822434bb1d7ec5583521a3f08e43a2521e0df922dde8ad18e666bac7
-
SHA512
bbfd91afee7e86e55a9df18b731b6c6fbcb15126d671fd948436136b8bb5cdfb008cf085a07bf420bff49ff2b8e49a1dc016fd1b3911ef77c35ce8eddcb64222
-
SSDEEP
12288:xK8/Pe5BdKVfxaaQ5k8eavxQo8yBF9gp5wdnq1J4edrDJlkyDLS2+Z0S1pOJNaiU:xjW5/k+kX66ov3pIDvl/u1p2aimX
Static task
static1
Behavioral task
behavioral1
Sample
3fae62e5822434bb1d7ec5583521a3f08e43a2521e0df922dde8ad18e666bac7.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3fae62e5822434bb1d7ec5583521a3f08e43a2521e0df922dde8ad18e666bac7.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5638734202:AAGtmxeBejf_B31jf-Jxq-3VqxA7KKy5Voc/
Targets
-
-
Target
3fae62e5822434bb1d7ec5583521a3f08e43a2521e0df922dde8ad18e666bac7.exe
-
Size
657KB
-
MD5
e793f299a066e0ad088a6369f3c18c6b
-
SHA1
6a0ee684e49cda54351f8f737bbd7fa33a9af14d
-
SHA256
3fae62e5822434bb1d7ec5583521a3f08e43a2521e0df922dde8ad18e666bac7
-
SHA512
bbfd91afee7e86e55a9df18b731b6c6fbcb15126d671fd948436136b8bb5cdfb008cf085a07bf420bff49ff2b8e49a1dc016fd1b3911ef77c35ce8eddcb64222
-
SSDEEP
12288:xK8/Pe5BdKVfxaaQ5k8eavxQo8yBF9gp5wdnq1J4edrDJlkyDLS2+Z0S1pOJNaiU:xjW5/k+kX66ov3pIDvl/u1p2aimX
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-