General
-
Target
71840cdbbc1ce602a11c0f59ca8b61176d0f1fc6c73a64aecfd1b3f4d9026582
-
Size
688KB
-
Sample
240330-bzag1seb4s
-
MD5
699d6146a8c0910f57449785f7138a5a
-
SHA1
b4bf00d7e3b6f107558ca621fa14f0cd2a313684
-
SHA256
71840cdbbc1ce602a11c0f59ca8b61176d0f1fc6c73a64aecfd1b3f4d9026582
-
SHA512
ec50711c28ca0edb266e6740b722a1b4c48a8f3337e1506a12b2ebc0198678412e2f60002e1223e1a8177a4e06717b7d3fff93610dabde5ef140b4588eb0e222
-
SSDEEP
12288:XALK1eoPVyKi3DxoX+YokZ2+D/ouR1eJF/pcI0+KGg6fE:Qi/G3t6+Y32i/oualTVdfE
Static task
static1
Behavioral task
behavioral1
Sample
71840cdbbc1ce602a11c0f59ca8b61176d0f1fc6c73a64aecfd1b3f4d9026582.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
71840cdbbc1ce602a11c0f59ca8b61176d0f1fc6c73a64aecfd1b3f4d9026582.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6562689250:AAHKeJIrACTzsm0Y0MY4lux3WJo_6q58UEo/
Targets
-
-
Target
71840cdbbc1ce602a11c0f59ca8b61176d0f1fc6c73a64aecfd1b3f4d9026582
-
Size
688KB
-
MD5
699d6146a8c0910f57449785f7138a5a
-
SHA1
b4bf00d7e3b6f107558ca621fa14f0cd2a313684
-
SHA256
71840cdbbc1ce602a11c0f59ca8b61176d0f1fc6c73a64aecfd1b3f4d9026582
-
SHA512
ec50711c28ca0edb266e6740b722a1b4c48a8f3337e1506a12b2ebc0198678412e2f60002e1223e1a8177a4e06717b7d3fff93610dabde5ef140b4588eb0e222
-
SSDEEP
12288:XALK1eoPVyKi3DxoX+YokZ2+D/ouR1eJF/pcI0+KGg6fE:Qi/G3t6+Y32i/oualTVdfE
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-