General
-
Target
d5eda0e68317a31989c6e5f296a87364399cc58b471a8c7e43b9e0bc5f08108d
-
Size
615KB
-
Sample
240329-bpcvdsec57
-
MD5
dc1e57e40438a110970471ad27cea415
-
SHA1
076c454470c65d9d97140bea2e7b59530f90873a
-
SHA256
d5eda0e68317a31989c6e5f296a87364399cc58b471a8c7e43b9e0bc5f08108d
-
SHA512
3bab74f1e2b6840df5ed2c73be6d110c44e7dd4257291a2dde7007d4e3fb64ec1fdecfc13c8d1d769d45b0fb09e9c22b8b97b0ee9e63b4027bb66d67eb57cf90
-
SSDEEP
12288:VAQohHRiNEsSmWymhD2NMRHQuy5+kyZT0bPc1nGMzvBB+W0/Nm7:Ox+xSR2NMeu4+F90bPwJl/0lm7
Static task
static1
Behavioral task
behavioral1
Sample
d5eda0e68317a31989c6e5f296a87364399cc58b471a8c7e43b9e0bc5f08108d.exe
Resource
win7-20240221-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot7192961923:AAEu0sYs8DVbOCj8GP81IJlqXCHjJ_Qooak/
Targets
-
-
Target
d5eda0e68317a31989c6e5f296a87364399cc58b471a8c7e43b9e0bc5f08108d
-
Size
615KB
-
MD5
dc1e57e40438a110970471ad27cea415
-
SHA1
076c454470c65d9d97140bea2e7b59530f90873a
-
SHA256
d5eda0e68317a31989c6e5f296a87364399cc58b471a8c7e43b9e0bc5f08108d
-
SHA512
3bab74f1e2b6840df5ed2c73be6d110c44e7dd4257291a2dde7007d4e3fb64ec1fdecfc13c8d1d769d45b0fb09e9c22b8b97b0ee9e63b4027bb66d67eb57cf90
-
SSDEEP
12288:VAQohHRiNEsSmWymhD2NMRHQuy5+kyZT0bPc1nGMzvBB+W0/Nm7:Ox+xSR2NMeu4+F90bPwJl/0lm7
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-