General
-
Target
8d4a9aa1f16b947465a4515d48fe6995f2d670e2f883fa564e44f41f7bf298e1
-
Size
1.1MB
-
Sample
240327-br59qabh8y
-
MD5
105970e3bbd77059f02ae683ed8686a3
-
SHA1
faf916cfb604a1a99d244634ebb30231f6dcde4c
-
SHA256
8d4a9aa1f16b947465a4515d48fe6995f2d670e2f883fa564e44f41f7bf298e1
-
SHA512
f1cbad7a09e2c5dbc7575c99ecfc145e6bbdf03bc617c5b7a5b0a1f76340d16e8f4a495af786510c7bc34442adec4683cd9e4387754e016dc8331dbcf1c85d4b
-
SSDEEP
24576:GqDEvCTbMWu7rQYlBQcBiT6rpFd+zYRHaJUE:GTvC/MTQYxsWPkzYp
Static task
static1
Behavioral task
behavioral1
Sample
8d4a9aa1f16b947465a4515d48fe6995f2d670e2f883fa564e44f41f7bf298e1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8d4a9aa1f16b947465a4515d48fe6995f2d670e2f883fa564e44f41f7bf298e1.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.siscop.com.co - Port:
21 - Username:
[email protected] - Password:
+5s48Ia2&-(t
Targets
-
-
Target
8d4a9aa1f16b947465a4515d48fe6995f2d670e2f883fa564e44f41f7bf298e1
-
Size
1.1MB
-
MD5
105970e3bbd77059f02ae683ed8686a3
-
SHA1
faf916cfb604a1a99d244634ebb30231f6dcde4c
-
SHA256
8d4a9aa1f16b947465a4515d48fe6995f2d670e2f883fa564e44f41f7bf298e1
-
SHA512
f1cbad7a09e2c5dbc7575c99ecfc145e6bbdf03bc617c5b7a5b0a1f76340d16e8f4a495af786510c7bc34442adec4683cd9e4387754e016dc8331dbcf1c85d4b
-
SSDEEP
24576:GqDEvCTbMWu7rQYlBQcBiT6rpFd+zYRHaJUE:GTvC/MTQYxsWPkzYp
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-