General
-
Target
7170058dac6c9006c7fd6273b4a824277cbac873f61c117b22279ce0cd425b62
-
Size
962KB
-
Sample
230507-lf2r9sga5s
-
MD5
3217930a87bf8b38ba8d474862548853
-
SHA1
3ffc1d60ad13db9a291f03b0f8ff35c0281e7d5d
-
SHA256
7170058dac6c9006c7fd6273b4a824277cbac873f61c117b22279ce0cd425b62
-
SHA512
295b41f2035888446230a29f214cdfcc78d93eab3f1720387997b16630bda3698b4f3dabd31b4cbf79dc2d319d8cfb59b442ec2c72c74afec1e3b6143a91112f
-
SSDEEP
24576:R7Q12srPK7afcfX/9e4+l2gNG82VDkB0+9ud:R+Iafcle4U2gNGnYB0z
Static task
static1
Behavioral task
behavioral1
Sample
7170058dac6c9006c7fd6273b4a824277cbac873f61c117b22279ce0cd425b62.exe
Resource
win10-20230220-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5641589629:AAE7PbYkX7JPIEd1r5HHvkG2FiDsJ1HpC0c/
Targets
-
-
Target
7170058dac6c9006c7fd6273b4a824277cbac873f61c117b22279ce0cd425b62
-
Size
962KB
-
MD5
3217930a87bf8b38ba8d474862548853
-
SHA1
3ffc1d60ad13db9a291f03b0f8ff35c0281e7d5d
-
SHA256
7170058dac6c9006c7fd6273b4a824277cbac873f61c117b22279ce0cd425b62
-
SHA512
295b41f2035888446230a29f214cdfcc78d93eab3f1720387997b16630bda3698b4f3dabd31b4cbf79dc2d319d8cfb59b442ec2c72c74afec1e3b6143a91112f
-
SSDEEP
24576:R7Q12srPK7afcfX/9e4+l2gNG82VDkB0+9ud:R+Iafcle4U2gNGnYB0z
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-