General
-
Target
317c03c3a7c126fc355d1c60470d60ef41f0d0298cd7d9ba51c560c7aae3f5a3
-
Size
377KB
-
Sample
240425-dr75esee6t
-
MD5
c88b56c4a39b7d2e514f93604cb16aae
-
SHA1
6ea4335a9fd4a2c5fdf4799d76aebbdf06888d9e
-
SHA256
317c03c3a7c126fc355d1c60470d60ef41f0d0298cd7d9ba51c560c7aae3f5a3
-
SHA512
6a0b184c18812e41b429cb351fa0e951942a11e9af29544b4b98a9ef7e1e3e71966b3c9f80bdd3e1a1dc1531aa8c8b300839d35874e7be237f8993ce77c74fa1
-
SSDEEP
6144:TI8DsNU40ZbL29I+m/UJopmt8RsXiJmbxNZ4bx+NPtzbcbZi3fHolJQQFt6F:HsTNm/+t8/4VuCP5agPol6
Static task
static1
Behavioral task
behavioral1
Sample
317c03c3a7c126fc355d1c60470d60ef41f0d0298cd7d9ba51c560c7aae3f5a3.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
317c03c3a7c126fc355d1c60470d60ef41f0d0298cd7d9ba51c560c7aae3f5a3.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
317c03c3a7c126fc355d1c60470d60ef41f0d0298cd7d9ba51c560c7aae3f5a3
-
Size
377KB
-
MD5
c88b56c4a39b7d2e514f93604cb16aae
-
SHA1
6ea4335a9fd4a2c5fdf4799d76aebbdf06888d9e
-
SHA256
317c03c3a7c126fc355d1c60470d60ef41f0d0298cd7d9ba51c560c7aae3f5a3
-
SHA512
6a0b184c18812e41b429cb351fa0e951942a11e9af29544b4b98a9ef7e1e3e71966b3c9f80bdd3e1a1dc1531aa8c8b300839d35874e7be237f8993ce77c74fa1
-
SSDEEP
6144:TI8DsNU40ZbL29I+m/UJopmt8RsXiJmbxNZ4bx+NPtzbcbZi3fHolJQQFt6F:HsTNm/+t8/4VuCP5agPol6
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-