General
-
Target
0e98017a6018b750789e8b7f6f4a0ee880512d36496e503082799df228bfcc0c
-
Size
680KB
-
Sample
230330-rltlqsda46
-
MD5
89ab448998a91c5b800515522343a67b
-
SHA1
1a6e87e4d9a0843da2fa15f840d33f7b4cbcd20a
-
SHA256
0e98017a6018b750789e8b7f6f4a0ee880512d36496e503082799df228bfcc0c
-
SHA512
cc23df08173e5782e9536fa5f5706feac26ab122d40d8a610357607ea5ebfe89301c7001bad3680eedabfb912b0e2ab89f8c7e6659f311ee0c419c4eaeff0448
-
SSDEEP
12288:leJ/sIt3ehOoLVRhXcVVTJmk95wLoRfHP37z6ANHHK9+QzLAyVFuddlENnSimOM9:9wGlMxQ45wLoBdNHq9+8LAyStQnSimX
Static task
static1
Behavioral task
behavioral1
Sample
0e98017a6018b750789e8b7f6f4a0ee880512d36496e503082799df228bfcc0c.exe
Resource
win10-20230220-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6258465660:AAFAPHkxw9lv-YgWk0oo5r_nv12k7nJhSWA/
Targets
-
-
Target
0e98017a6018b750789e8b7f6f4a0ee880512d36496e503082799df228bfcc0c
-
Size
680KB
-
MD5
89ab448998a91c5b800515522343a67b
-
SHA1
1a6e87e4d9a0843da2fa15f840d33f7b4cbcd20a
-
SHA256
0e98017a6018b750789e8b7f6f4a0ee880512d36496e503082799df228bfcc0c
-
SHA512
cc23df08173e5782e9536fa5f5706feac26ab122d40d8a610357607ea5ebfe89301c7001bad3680eedabfb912b0e2ab89f8c7e6659f311ee0c419c4eaeff0448
-
SSDEEP
12288:leJ/sIt3ehOoLVRhXcVVTJmk95wLoRfHP37z6ANHHK9+QzLAyVFuddlENnSimOM9:9wGlMxQ45wLoBdNHq9+8LAyStQnSimX
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-