General
-
Target
4b6d9c8a1dadf29aa15401c7c1a402d382bf8305ed6887f77603b2cb895fc93b
-
Size
688KB
-
Sample
231202-b759nahc8s
-
MD5
21a2ca225f66a6e0c61280bb5aa4e93e
-
SHA1
51530ba354cfe93f393f953049309b9eaf4244e0
-
SHA256
4b6d9c8a1dadf29aa15401c7c1a402d382bf8305ed6887f77603b2cb895fc93b
-
SHA512
a70f29a1dff09ca29f7f6bc2e06c2c0c82cfb78bd9fccd080cad9813cdbd5eb3051ca56b5ab80e21c9bc0a476d6173fcb12250be1d202f2b69ee1f1468670962
-
SSDEEP
12288:iCpvJYIXIb7Ta0A4ZHDWCTEY2yIotj9D49m1WYX7F+tLZurYvDWE3:RvJ1InIgHKaE7yIV9m84FSLZ8kH
Static task
static1
Behavioral task
behavioral1
Sample
4b6d9c8a1dadf29aa15401c7c1a402d382bf8305ed6887f77603b2cb895fc93b.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
4b6d9c8a1dadf29aa15401c7c1a402d382bf8305ed6887f77603b2cb895fc93b.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1158669333552169031/JDVIUrIPRDFArhYLJtuVY40DaK1KV7rtH9wZuJWWynu212vmqEwNYKJHXzbfaOWZBsRP
Targets
-
-
Target
4b6d9c8a1dadf29aa15401c7c1a402d382bf8305ed6887f77603b2cb895fc93b
-
Size
688KB
-
MD5
21a2ca225f66a6e0c61280bb5aa4e93e
-
SHA1
51530ba354cfe93f393f953049309b9eaf4244e0
-
SHA256
4b6d9c8a1dadf29aa15401c7c1a402d382bf8305ed6887f77603b2cb895fc93b
-
SHA512
a70f29a1dff09ca29f7f6bc2e06c2c0c82cfb78bd9fccd080cad9813cdbd5eb3051ca56b5ab80e21c9bc0a476d6173fcb12250be1d202f2b69ee1f1468670962
-
SSDEEP
12288:iCpvJYIXIb7Ta0A4ZHDWCTEY2yIotj9D49m1WYX7F+tLZurYvDWE3:RvJ1InIgHKaE7yIV9m84FSLZ8kH
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-