General
-
Target
f913a124d4994bfe0002cd25423036f6707d18cabb2506ed9b48508dca3d1b0c.img
-
Size
1.6MB
-
Sample
240424-chbjeseb57
-
MD5
acb944b1e95d034509236638d3f794be
-
SHA1
83b4d06cf435058fac4cb3c0a8b18dfecd505adb
-
SHA256
f913a124d4994bfe0002cd25423036f6707d18cabb2506ed9b48508dca3d1b0c
-
SHA512
9d95e5fc282d61f6b5166733be3d56243a0ee06402d5dff7324563d5859fff6953b24c010b954e8725309daad0ec3a9b23bbd0a3475b3ef4e294fd4118fb20f7
-
SSDEEP
12288:Kx7SXc87X+bXPXST4Fof1XUhJePHq3EdfX4xw5cRK5JNHrU32YWrM9uOAHnVRS3h:mSXcH/X4yBevq0dAxnRK4iA9ga
Static task
static1
Behavioral task
behavioral1
Sample
SC_ADACONI_N.24040122PDF.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SC_ADACONI_N.24040122PDF.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.rusticpensiune.ro - Port:
21 - Username:
[email protected] - Password:
99AM}+NZ&CCq!4Vq)9!(zXx01.lQ!~nS.fBnY,4Z~fjHnGo*B3Gd;B{Q1!%-Xw--%vn^0%nt
Extracted
Protocol: ftp- Host:
ftp.rusticpensiune.ro - Port:
21 - Username:
[email protected] - Password:
99AM}+NZ&CCq!4Vq)9!(zXx01.lQ!~nS.fBnY,4Z~fjHnGo*B3Gd;B{Q1!%-Xw--%vn^0%nt
Targets
-
-
Target
SC_ADACONI_N.24040122PDF.exe
-
Size
1.1MB
-
MD5
2a793bfa3d22c67153842279520b366c
-
SHA1
953fe50e20ef01e1afbc8112f7e1d6167646083b
-
SHA256
de9d7a5b1df10e151659a0867c4c7004ff4f023acdb9071f88b0939c1cb37dea
-
SHA512
76c3e3c4e576eb5f3cb1549e64652156776b54e29e2b32d24075301cbda89b8f45071ad7e307f201cf60f83bf690b53343d8f2399ddaf7d61ed6ca4b967a6df5
-
SSDEEP
12288:xx7SXc87X+bXPXST4Fof1XUhJePHq3EdfX4xw5cRK5JNHrU32YWrM9uOAHnVRS3h:rSXcH/X4yBevq0dAxnRK4iA9ga
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects executables referencing Windows vault credential objects. Observed in infostealers
-
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
-
Detects executables referencing many email and collaboration clients. Observed in information stealers
-
Detects executables referencing many file transfer clients. Observed in information stealers
-
Suspicious use of SetThreadContext
-