General
-
Target
Proforma Request.exe
-
Size
359KB
-
Sample
240424-qkhbmsae78
-
MD5
0e714431357dd37266fe95d5b2b52f8e
-
SHA1
c003a2816c6da9857829984bbd8051d60eba5cd1
-
SHA256
36dd06fa770b353aa0716188d181d371300a847b6867878f4cf15c5b6b40d751
-
SHA512
0e862e6379ed36cd5acd2b0203c6c44f2cd861111d7efaf6b18ee5d4171be2aebf2a0c2ad01bc6efa2dcbb57982f704f33d2c97d86c304b16aab1fdd970f8460
-
SSDEEP
6144:fCjPKO4SIv6vytHU9ZTw8RgWuJvxLVbUkBEIAd7+GItYdqJfDJPwZICr:KjaSIv6vytH7WyNU1+GkBW
Static task
static1
Behavioral task
behavioral1
Sample
Proforma Request.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
Proforma Request.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6240128422:AAF92bsfXTRwFqVrbwbkd53IuHO7T3W8CXQ/
Targets
-
-
Target
Proforma Request.exe
-
Size
359KB
-
MD5
0e714431357dd37266fe95d5b2b52f8e
-
SHA1
c003a2816c6da9857829984bbd8051d60eba5cd1
-
SHA256
36dd06fa770b353aa0716188d181d371300a847b6867878f4cf15c5b6b40d751
-
SHA512
0e862e6379ed36cd5acd2b0203c6c44f2cd861111d7efaf6b18ee5d4171be2aebf2a0c2ad01bc6efa2dcbb57982f704f33d2c97d86c304b16aab1fdd970f8460
-
SSDEEP
6144:fCjPKO4SIv6vytHU9ZTw8RgWuJvxLVbUkBEIAd7+GItYdqJfDJPwZICr:KjaSIv6vytH7WyNU1+GkBW
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-