General
-
Target
8d1d78a3ed7da56ab5783ebcc5e7c0b22921179f3d124aa7511bb952d199ef2bexe.exe
-
Size
639KB
-
Sample
231207-ybdabsgc2y
-
MD5
78cdd7631daa770440ea9fa871fd8d63
-
SHA1
7a3e6d5992612d2f7b98d35f8ab2d96aa1950f61
-
SHA256
8d1d78a3ed7da56ab5783ebcc5e7c0b22921179f3d124aa7511bb952d199ef2b
-
SHA512
c915fe8ddc1e3b90d4e53ba30dd30336ef8a45843dff42413300c44ac0d67a82c92565efe9df2f8b8aeb59e15adc2942eeed7bec24292170236b9e4d704690f4
-
SSDEEP
12288:jE0QaueH5qRILAmLngh9QDBSfKaPUD2vNkbMRYjWOx:jE4qRILAmmuAOD/bMvO
Static task
static1
Behavioral task
behavioral1
Sample
8d1d78a3ed7da56ab5783ebcc5e7c0b22921179f3d124aa7511bb952d199ef2bexe.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
8d1d78a3ed7da56ab5783ebcc5e7c0b22921179f3d124aa7511bb952d199ef2bexe.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6217230824:AAFCGEN5vk1xCq7NOzRdvuxKD2rS56-qo2g/
Targets
-
-
Target
8d1d78a3ed7da56ab5783ebcc5e7c0b22921179f3d124aa7511bb952d199ef2bexe.exe
-
Size
639KB
-
MD5
78cdd7631daa770440ea9fa871fd8d63
-
SHA1
7a3e6d5992612d2f7b98d35f8ab2d96aa1950f61
-
SHA256
8d1d78a3ed7da56ab5783ebcc5e7c0b22921179f3d124aa7511bb952d199ef2b
-
SHA512
c915fe8ddc1e3b90d4e53ba30dd30336ef8a45843dff42413300c44ac0d67a82c92565efe9df2f8b8aeb59e15adc2942eeed7bec24292170236b9e4d704690f4
-
SSDEEP
12288:jE0QaueH5qRILAmLngh9QDBSfKaPUD2vNkbMRYjWOx:jE4qRILAmmuAOD/bMvO
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-