General
-
Target
Proforma Request.Gz
-
Size
269KB
-
Sample
240425-c1kvtaea4w
-
MD5
991281eeb023531505b798ddc7fb8dce
-
SHA1
c7440ddf20b614022907a67b1a2c5333f2a88da4
-
SHA256
c38ee9a85440d34b017ac4f9d609551108f4d65dee1013329162dc37cfcc76d1
-
SHA512
b1bea8cc7a1e859d83123bed5f661898b59796f649d8f26d366a71ebb309bf25e303484be355ff1aa6580b21fb4ae8eb7e8b89a903111d0086a2507a34eac3f7
-
SSDEEP
6144:eOTe4V8icJpif/Ewcn+dLXmLDjM60vPRXnqxrF9U8WDgF:eOa+8igY3Hcn+NXmXEXRXn4r8D8
Static task
static1
Behavioral task
behavioral1
Sample
Proforma Request.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Proforma Request.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6240128422:AAF92bsfXTRwFqVrbwbkd53IuHO7T3W8CXQ/
Targets
-
-
Target
Proforma Request.exe
-
Size
359KB
-
MD5
0e714431357dd37266fe95d5b2b52f8e
-
SHA1
c003a2816c6da9857829984bbd8051d60eba5cd1
-
SHA256
36dd06fa770b353aa0716188d181d371300a847b6867878f4cf15c5b6b40d751
-
SHA512
0e862e6379ed36cd5acd2b0203c6c44f2cd861111d7efaf6b18ee5d4171be2aebf2a0c2ad01bc6efa2dcbb57982f704f33d2c97d86c304b16aab1fdd970f8460
-
SSDEEP
6144:fCjPKO4SIv6vytHU9ZTw8RgWuJvxLVbUkBEIAd7+GItYdqJfDJPwZICr:KjaSIv6vytH7WyNU1+GkBW
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-