General
-
Target
bdc5763cbacf39b28821ffa9607e6bda69a36546d593c6cadbba527d78c44b46
-
Size
731KB
-
Sample
231206-cy46nsad27
-
MD5
e581f6dab3bc5bcced6692149e8e8630
-
SHA1
47d84b6d097f626ea008eca6d5c66692392f3d30
-
SHA256
bdc5763cbacf39b28821ffa9607e6bda69a36546d593c6cadbba527d78c44b46
-
SHA512
4520e8164652278918d85849d7f1c0ba674868afe180b4f31b4a511ac2b4ffb036a62b4c63b1e2b2eb10d9e39baf2b3f6bc040e09bf791af1e71caec14708412
-
SSDEEP
12288:tF5nF8ME6jD/dTtu0ZxlnlQ1DZUVtKPq1qEL71AIxN/7fD9+qyns8+0lo9iYgMkc:tFPtD/dc0hnS4KPqTLZrxNjfp+lswlTc
Static task
static1
Behavioral task
behavioral1
Sample
bdc5763cbacf39b28821ffa9607e6bda69a36546d593c6cadbba527d78c44b46.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
bdc5763cbacf39b28821ffa9607e6bda69a36546d593c6cadbba527d78c44b46.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6535471352:AAG5LLOdoWfEV_2o0t-P_WXmz7myHdZBEIQ/
Targets
-
-
Target
bdc5763cbacf39b28821ffa9607e6bda69a36546d593c6cadbba527d78c44b46
-
Size
731KB
-
MD5
e581f6dab3bc5bcced6692149e8e8630
-
SHA1
47d84b6d097f626ea008eca6d5c66692392f3d30
-
SHA256
bdc5763cbacf39b28821ffa9607e6bda69a36546d593c6cadbba527d78c44b46
-
SHA512
4520e8164652278918d85849d7f1c0ba674868afe180b4f31b4a511ac2b4ffb036a62b4c63b1e2b2eb10d9e39baf2b3f6bc040e09bf791af1e71caec14708412
-
SSDEEP
12288:tF5nF8ME6jD/dTtu0ZxlnlQ1DZUVtKPq1qEL71AIxN/7fD9+qyns8+0lo9iYgMkc:tFPtD/dc0hnS4KPqTLZrxNjfp+lswlTc
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-