General
-
Target
1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695exe.exe
-
Size
762KB
-
Sample
240107-x3mgmscdaq
-
MD5
3e9a543b85c85a0b808902b0b6cef9b2
-
SHA1
29d589b838b4e1a5e54a6bfe52da0d5859609865
-
SHA256
1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695
-
SHA512
f212b3a2f4c25701df3f41be93c13cf9a6a84e1affd4e8b0f7b9fb5bc0689a1b3a1c55052c99fca314f540199997a8c265f9f447fe8b013a085a199a7fffb3c6
-
SSDEEP
12288:aHW7TohIU2CoLBPdV+GLBOeUjYb9qUp5jlnRLm5bvL2z4is:a27SELNdYGL8eUjYbMUp5RnRLm5LLw4
Static task
static1
Behavioral task
behavioral1
Sample
1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695exe.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695exe.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6857395601:AAEr0Ki03_UqNs4qlOxRNOhnjU8odyo6de4/
Targets
-
-
Target
1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695exe.exe
-
Size
762KB
-
MD5
3e9a543b85c85a0b808902b0b6cef9b2
-
SHA1
29d589b838b4e1a5e54a6bfe52da0d5859609865
-
SHA256
1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695
-
SHA512
f212b3a2f4c25701df3f41be93c13cf9a6a84e1affd4e8b0f7b9fb5bc0689a1b3a1c55052c99fca314f540199997a8c265f9f447fe8b013a085a199a7fffb3c6
-
SSDEEP
12288:aHW7TohIU2CoLBPdV+GLBOeUjYb9qUp5jlnRLm5bvL2z4is:a27SELNdYGL8eUjYbMUp5RnRLm5LLw4
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-