General
-
Target
RFQ_20231201-876658xls.exe
-
Size
738KB
-
Sample
231201-q8nhkaac39
-
MD5
33a2aca5866de0f687e0d5d64c1feb9b
-
SHA1
42c8a406496525574a3954a219968db17eb7877f
-
SHA256
cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4
-
SHA512
0df31bd83fb732f9c228807b1ff0897a1f58198a3d9baf544eec95dbae2d19de490a47e2217455438eed4132fb6a5b5f834e74c8210d7741914cc74e4fd65cb6
-
SSDEEP
12288:kI2ICYm2L/c37RaJFheLHUvGnJ6zsCMgzF+Nm3jZ738FQTft:AX27c3yQL0vyljgzAwjZj8C
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_20231201-876658xls.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
RFQ_20231201-876658xls.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.dzine.com.tr - Port:
21 - Username:
dzinecom - Password:
Dzine21.
Extracted
Protocol: ftp- Host:
ftp.dzine.com.tr - Port:
21 - Username:
dzinecom - Password:
Dzine21.
Targets
-
-
Target
RFQ_20231201-876658xls.exe
-
Size
738KB
-
MD5
33a2aca5866de0f687e0d5d64c1feb9b
-
SHA1
42c8a406496525574a3954a219968db17eb7877f
-
SHA256
cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4
-
SHA512
0df31bd83fb732f9c228807b1ff0897a1f58198a3d9baf544eec95dbae2d19de490a47e2217455438eed4132fb6a5b5f834e74c8210d7741914cc74e4fd65cb6
-
SSDEEP
12288:kI2ICYm2L/c37RaJFheLHUvGnJ6zsCMgzF+Nm3jZ738FQTft:AX27c3yQL0vyljgzAwjZj8C
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-