General
-
Target
72bb6fe0dceb43f8331e3aa2ab088034b54db0b5f0fb8691dbf948e63f585e27
-
Size
606KB
-
Sample
240327-bj3tmagf68
-
MD5
b8662b46c395be36c5e3c72af545cf27
-
SHA1
beb43c0a2d0bf97ef9b62755c39122af8fcf48f9
-
SHA256
72bb6fe0dceb43f8331e3aa2ab088034b54db0b5f0fb8691dbf948e63f585e27
-
SHA512
7fcdcb691c6f68a3df24a17d1204fe6231ea8049aab477462dd40acf147d0f120961acc4c779eb1e8cd53b1b701aef1df56bfc414516f177f5e0d722e90383a3
-
SSDEEP
12288:5XC/Wjud2ovDTy2V4bZmeiJM6w6YkKiks4cSAu7gnnr3oW:5SeKdHtex6w6YplvcSJ74r4W
Static task
static1
Behavioral task
behavioral1
Sample
Lsbgddffz3E3gUR.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Lsbgddffz3E3gUR.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1222063930139086928/2Vg1Z1z7AWyTYIiICGAds8u69Kb-0e0rknSGkQxVLW2pI6G-7AwX8FCkrKw70QfPItcz
Targets
-
-
Target
Lsbgddffz3E3gUR.exe
-
Size
628KB
-
MD5
c2e1460408151bfafe7f52dfb4750afd
-
SHA1
49741ca58a04a95490df18ce1bfd697eced7e176
-
SHA256
378a5373cb0cdab87777f9864381aaeca5bb38f6bd97108feaeedef6f46ea512
-
SHA512
dbe5f730db165faa34563e1e967229568ac6deef0e1187e549b8d479f3cad1ad1dd85dfa598b8c7174ddd4d836a9da190e3b8d4e75b571f1b81bed9eab112f32
-
SSDEEP
12288:qa5Wgd2+vQo6mVoZZmcwJE4w6W0AYesYASN3hE5D84qI:ugd0oVI94w6WFjZASN3q5A4B
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-