General
-
Target
2f441107368afa9bd9d536d2d3f79284af91ae4e6568c93b170ad3aaa243205a
-
Size
771KB
-
Sample
240329-bn1vtsec47
-
MD5
1433df7a0c7d30eccc2973886763dd3c
-
SHA1
5524fd6fad6327287aefb807db8aca267ef81b23
-
SHA256
2f441107368afa9bd9d536d2d3f79284af91ae4e6568c93b170ad3aaa243205a
-
SHA512
c717cde6ebb72c81dd7af08aec4e18a99c667481746618b6e6122dc88d90f9c0e687e8e31c77d730b9fdabac25346bf716fc57712bfee9ae114be56c2030449f
-
SSDEEP
12288:t7spRsB6mNbI4sdgeMPHqwIR8jfkS5yZ8mZOduX6Pf/Jx8RTVUizeV:GpRsv5I4sivPARIJ50ROdA6PXkv
Static task
static1
Behavioral task
behavioral1
Sample
2f441107368afa9bd9d536d2d3f79284af91ae4e6568c93b170ad3aaa243205a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2f441107368afa9bd9d536d2d3f79284af91ae4e6568c93b170ad3aaa243205a.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6510566783:AAEqx5Uod2gO5hHDZ1xznAnHyO5uFneWegY/
Targets
-
-
Target
2f441107368afa9bd9d536d2d3f79284af91ae4e6568c93b170ad3aaa243205a
-
Size
771KB
-
MD5
1433df7a0c7d30eccc2973886763dd3c
-
SHA1
5524fd6fad6327287aefb807db8aca267ef81b23
-
SHA256
2f441107368afa9bd9d536d2d3f79284af91ae4e6568c93b170ad3aaa243205a
-
SHA512
c717cde6ebb72c81dd7af08aec4e18a99c667481746618b6e6122dc88d90f9c0e687e8e31c77d730b9fdabac25346bf716fc57712bfee9ae114be56c2030449f
-
SSDEEP
12288:t7spRsB6mNbI4sdgeMPHqwIR8jfkS5yZ8mZOduX6Pf/Jx8RTVUizeV:GpRsv5I4sivPARIJ50ROdA6PXkv
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-