General
-
Target
0a00a70873369c7ee7422b2a904ea697bcef44a892d36d6765bd38f0734cbf23
-
Size
693KB
-
Sample
240330-bw16kaea7x
-
MD5
83ca69da2810bf1141a4c233fbef22bf
-
SHA1
c867d5a005d1bdbfbae36217d3c2e35bf5eb39d5
-
SHA256
0a00a70873369c7ee7422b2a904ea697bcef44a892d36d6765bd38f0734cbf23
-
SHA512
88ed97278844df71fb92952f3aa87d035a368c85f6110e5c458a22a3c37a6fce7f9e4bb47be9960889291d3969e0301ef278ce1df4e9aa2f3ed8e578a56cccec
-
SSDEEP
12288:d3LK1Y329JVzo2sDzxULgr3Vns46RmDAGRNvw3xFCryOhBqX9WnhDTTdB4DVUBcM:NiYG9Jd+De8Tls/0DAew3ytGtkhDTTcO
Static task
static1
Behavioral task
behavioral1
Sample
0a00a70873369c7ee7422b2a904ea697bcef44a892d36d6765bd38f0734cbf23.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0a00a70873369c7ee7422b2a904ea697bcef44a892d36d6765bd38f0734cbf23.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/
Targets
-
-
Target
0a00a70873369c7ee7422b2a904ea697bcef44a892d36d6765bd38f0734cbf23
-
Size
693KB
-
MD5
83ca69da2810bf1141a4c233fbef22bf
-
SHA1
c867d5a005d1bdbfbae36217d3c2e35bf5eb39d5
-
SHA256
0a00a70873369c7ee7422b2a904ea697bcef44a892d36d6765bd38f0734cbf23
-
SHA512
88ed97278844df71fb92952f3aa87d035a368c85f6110e5c458a22a3c37a6fce7f9e4bb47be9960889291d3969e0301ef278ce1df4e9aa2f3ed8e578a56cccec
-
SSDEEP
12288:d3LK1Y329JVzo2sDzxULgr3Vns46RmDAGRNvw3xFCryOhBqX9WnhDTTdB4DVUBcM:NiYG9Jd+De8Tls/0DAew3ytGtkhDTTcO
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-