General
-
Target
9ff1b6916656ef628562de71e0fe52ce59ff0a60e618dce7c896239d52d934fa
-
Size
629KB
-
Sample
240328-b6wntsad92
-
MD5
e6dfc72e588f007ed550da1ac58f180d
-
SHA1
3f7eab75bdd8bf76b66b7e17db26e28fd305d6fd
-
SHA256
9ff1b6916656ef628562de71e0fe52ce59ff0a60e618dce7c896239d52d934fa
-
SHA512
8b360f3ba91af515aa0bf594b7ec582a7c2010652750f7e808fc29eaddc9eda6986b9843b151d01b0da5fb6b7426e82aa04826189b58e99af33e394e8d4c612a
-
SSDEEP
12288:6vN4OJNX+PGF0+O8UDidxMCYt7Q8JgYcJ4hSwvHqCyXps4sq3hQP:6vhIB+NDd+CYttJxcebHqCKR6
Static task
static1
Behavioral task
behavioral1
Sample
pziB4yM4FrJjxoA.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
pziB4yM4FrJjxoA.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot7073576997:AAHjVtyF2bgE69UMVGiHWA3fZk0LIdp1j_Y/
Targets
-
-
Target
pziB4yM4FrJjxoA.exe
-
Size
656KB
-
MD5
9949c58a8b33cbe0bcda599f0375f658
-
SHA1
3072f9c9d5f62ab5e8375cb51b6ce796977322dc
-
SHA256
83b34f0f0a0bdbc115ce0d7e44687ce16c35249650c9d242a646a5ed804fa2f1
-
SHA512
18949f9fc8092c04b4389b00109ea8d08ddb607d631e29902c9c92798950397453ff123f268f50d52732f6492ac7e22ca8a75091f70f2d1c9503f6e573308c1d
-
SSDEEP
12288:8H2iNlw0gPsV/68UditxkCOtzigHgYiJO/wwvJyMyXzN5tfd:C1XCcZttqCOtvHxiAVJy/nt
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-