General
-
Target
c65755542ef80f686a92407887a0df3e67b34df4c5f3ba89ed3670b3ba157d14
-
Size
677KB
-
Sample
240425-bvwvfsda2w
-
MD5
b7e87a4cec5ba0108548f139a538a540
-
SHA1
29d9da493c5e0d2fe9f05929edb0c54efae62495
-
SHA256
c65755542ef80f686a92407887a0df3e67b34df4c5f3ba89ed3670b3ba157d14
-
SHA512
e335da57dba4d48e54d981c60bef1b037c5ac5f231b9b54407edd63b39cf634d9d0533054f1929c2a9cd4bd89095364600a8ba4f7039ae985ae707b455cb758a
-
SSDEEP
12288:EDlv312Z353pl+PaytvI+rSoy1rBe6AegQowuzKEAVaTaAw5cO+A8c0dt+f:EDJ312Z5fHDeDQolOyX5ZA1
Static task
static1
Behavioral task
behavioral1
Sample
c65755542ef80f686a92407887a0df3e67b34df4c5f3ba89ed3670b3ba157d14.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c65755542ef80f686a92407887a0df3e67b34df4c5f3ba89ed3670b3ba157d14.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.jeepcommerce.rs - Port:
21 - Username:
[email protected] - Password:
Q6]7rLSD*gU2
Extracted
Protocol: ftp- Host:
ftp.jeepcommerce.rs - Port:
21 - Username:
[email protected] - Password:
Q6]7rLSD*gU2
Targets
-
-
Target
c65755542ef80f686a92407887a0df3e67b34df4c5f3ba89ed3670b3ba157d14
-
Size
677KB
-
MD5
b7e87a4cec5ba0108548f139a538a540
-
SHA1
29d9da493c5e0d2fe9f05929edb0c54efae62495
-
SHA256
c65755542ef80f686a92407887a0df3e67b34df4c5f3ba89ed3670b3ba157d14
-
SHA512
e335da57dba4d48e54d981c60bef1b037c5ac5f231b9b54407edd63b39cf634d9d0533054f1929c2a9cd4bd89095364600a8ba4f7039ae985ae707b455cb758a
-
SSDEEP
12288:EDlv312Z353pl+PaytvI+rSoy1rBe6AegQowuzKEAVaTaAw5cO+A8c0dt+f:EDJ312Z5fHDeDQolOyX5ZA1
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-