General
-
Target
3c00879a0e4e4a7d7b78bb8611bcc94f
-
Size
59KB
-
Sample
240424-jg4l5sfg53
-
MD5
3c00879a0e4e4a7d7b78bb8611bcc94f
-
SHA1
3ddd2f54b7fb54df60134318515fd61b119bc46f
-
SHA256
94ffc7bec0cef06550d739bc5014a3232c9218a50524de0464b53b6dbbd7ed5f
-
SHA512
4dfce826cf9f7456dd981b4a1b4c985d75c9c849434a94c5987bd08fe037217b5160441e23072c498b5e9c93e2d00d8c6e814ea1736e68724aa461881ab1b31c
-
SSDEEP
1536:cdukLI1gPDPTxyk0MfFCNqnlAEfen8TCQr:Yukk1gPDJzoGaEWn8Tv
Static task
static1
Behavioral task
behavioral1
Sample
3c00879a0e4e4a7d7b78bb8611bcc94f.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3c00879a0e4e4a7d7b78bb8611bcc94f.vbs
Resource
win10v2004-20240412-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.concaribe.com - Port:
21 - Username:
[email protected] - Password:
2ogFj^8ECV(?
Targets
-
-
Target
3c00879a0e4e4a7d7b78bb8611bcc94f
-
Size
59KB
-
MD5
3c00879a0e4e4a7d7b78bb8611bcc94f
-
SHA1
3ddd2f54b7fb54df60134318515fd61b119bc46f
-
SHA256
94ffc7bec0cef06550d739bc5014a3232c9218a50524de0464b53b6dbbd7ed5f
-
SHA512
4dfce826cf9f7456dd981b4a1b4c985d75c9c849434a94c5987bd08fe037217b5160441e23072c498b5e9c93e2d00d8c6e814ea1736e68724aa461881ab1b31c
-
SSDEEP
1536:cdukLI1gPDPTxyk0MfFCNqnlAEfen8TCQr:Yukk1gPDJzoGaEWn8Tv
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-