General
-
Target
WareTemp.rar
-
Size
3.4MB
-
Sample
240329-ctr1jsfb9y
-
MD5
53e9ddefdc7154a82e67cd7cf7fd7d1b
-
SHA1
f928105026b7a2ab98bb69bd9f5c492491951208
-
SHA256
d11aeb36fb91bc7bc060afc68d17083f51b8e09346066b07e28a125e3b0d211f
-
SHA512
4b259b19675349f17f1d6a2cb697aad1a45fe593de3ce2a6aaefd9f50d452f8d57631aa1fc5e7ce3959baf68a8c2d4baf9eca4c65d3a991dc9c59a3f55f4ae4f
-
SSDEEP
98304:260t98RDpuOd+5DQrZQ7uN7mr2ByxxLfQXH:B0t98RDE9QlQ7uFb
Static task
static1
Behavioral task
behavioral1
Sample
WareTemp.rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
WareTemp.rar
Resource
win10v2004-20231215-en
Malware Config
Targets
-
-
Target
WareTemp.rar
-
Size
3.4MB
-
MD5
53e9ddefdc7154a82e67cd7cf7fd7d1b
-
SHA1
f928105026b7a2ab98bb69bd9f5c492491951208
-
SHA256
d11aeb36fb91bc7bc060afc68d17083f51b8e09346066b07e28a125e3b0d211f
-
SHA512
4b259b19675349f17f1d6a2cb697aad1a45fe593de3ce2a6aaefd9f50d452f8d57631aa1fc5e7ce3959baf68a8c2d4baf9eca4c65d3a991dc9c59a3f55f4ae4f
-
SSDEEP
98304:260t98RDpuOd+5DQrZQ7uN7mr2ByxxLfQXH:B0t98RDE9QlQ7uFb
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-