General
-
Target
3217930a87bf8b38ba8d474862548853.bin
-
Size
741KB
-
Sample
230509-bk2mysdf73
-
MD5
334290ccf4136685b0e2a45cf3025731
-
SHA1
121ac58e83c3c58b2973b4c3b1228f1e0bb8ac53
-
SHA256
4a6fbecba1c154986b6a0f6990b1edc22db05aa08908161cb9c9924ed78dac26
-
SHA512
f45e088979ac8de10fb0b097f13313be96e8655a1824ebd1f6f3b41cbb1c7b3d18c6d3359d1a8c4decef625ba823680ca5d63d363446463e84ee94b9c40d24e6
-
SSDEEP
12288:DXGI1vusIvqzEFQv1wJ8+fyK5n+kEzeEluowhiB:TG0tHEagfvwkEJl2hu
Static task
static1
Behavioral task
behavioral1
Sample
7170058dac6c9006c7fd6273b4a824277cbac873f61c117b22279ce0cd425b62.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
7170058dac6c9006c7fd6273b4a824277cbac873f61c117b22279ce0cd425b62.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5641589629:AAE7PbYkX7JPIEd1r5HHvkG2FiDsJ1HpC0c/
Targets
-
-
Target
7170058dac6c9006c7fd6273b4a824277cbac873f61c117b22279ce0cd425b62.exe
-
Size
962KB
-
MD5
3217930a87bf8b38ba8d474862548853
-
SHA1
3ffc1d60ad13db9a291f03b0f8ff35c0281e7d5d
-
SHA256
7170058dac6c9006c7fd6273b4a824277cbac873f61c117b22279ce0cd425b62
-
SHA512
295b41f2035888446230a29f214cdfcc78d93eab3f1720387997b16630bda3698b4f3dabd31b4cbf79dc2d319d8cfb59b442ec2c72c74afec1e3b6143a91112f
-
SSDEEP
24576:R7Q12srPK7afcfX/9e4+l2gNG82VDkB0+9ud:R+Iafcle4U2gNGnYB0z
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-