General
-
Target
326eecc7ae8ebad8b113bf2ace45105cbdca77c39dbd836b13fce6f9eefa08d9
-
Size
707KB
-
Sample
240327-cn4gdsdc6s
-
MD5
3b923e8c268d2d7a0652357be9da9209
-
SHA1
5472044736c57420eab387491008c1d8bbf1c3af
-
SHA256
326eecc7ae8ebad8b113bf2ace45105cbdca77c39dbd836b13fce6f9eefa08d9
-
SHA512
e7ab5e8c9d94181d8f5eb115bcc2c0f246c2e12cc94261448a92f7b049871f832cd5dc75a9ce054ba0ca15d3d1f9db531f18a5df6fa962be957b3578ccd00959
-
SSDEEP
12288:7Cvzpa5WEHfbz7QMsUyuHL/EFbja0UYkdXFRzERFPjW6y927PjGUts:277EHfbz7uNOgadYkOjRyMSU
Static task
static1
Behavioral task
behavioral1
Sample
326eecc7ae8ebad8b113bf2ace45105cbdca77c39dbd836b13fce6f9eefa08d9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
326eecc7ae8ebad8b113bf2ace45105cbdca77c39dbd836b13fce6f9eefa08d9.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5472075572:AAH72ryjgTKG52VYCqF2mpPaWaPLe7C91tE/
Targets
-
-
Target
326eecc7ae8ebad8b113bf2ace45105cbdca77c39dbd836b13fce6f9eefa08d9
-
Size
707KB
-
MD5
3b923e8c268d2d7a0652357be9da9209
-
SHA1
5472044736c57420eab387491008c1d8bbf1c3af
-
SHA256
326eecc7ae8ebad8b113bf2ace45105cbdca77c39dbd836b13fce6f9eefa08d9
-
SHA512
e7ab5e8c9d94181d8f5eb115bcc2c0f246c2e12cc94261448a92f7b049871f832cd5dc75a9ce054ba0ca15d3d1f9db531f18a5df6fa962be957b3578ccd00959
-
SSDEEP
12288:7Cvzpa5WEHfbz7QMsUyuHL/EFbja0UYkdXFRzERFPjW6y927PjGUts:277EHfbz7uNOgadYkOjRyMSU
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-