General
-
Target
75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211
-
Size
831KB
-
Sample
240425-dswssaee7x
-
MD5
46cfa299526c4b456ca0da04d70954dc
-
SHA1
9f66c851d80b921cce5f76533226e6d2d159d448
-
SHA256
75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211
-
SHA512
d0911768b699be59b73a931efcf52af7a5c771541b87425d5759ab63e17e79eb8d22849983affa3ec7abadb10aa488dd3e5479e089b31a0c0f25e83f4ccf74b1
-
SSDEEP
12288:VXH4jhk6ATS3fHfbpKU4ebexSQyD0DMCa7m:Su6AW3fHDpgOdAPaa
Static task
static1
Behavioral task
behavioral1
Sample
75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://beirutrest.com - Port:
21 - Username:
[email protected] - Password:
9yXQ39wz(uL+
Extracted
Protocol: ftp- Host:
beirutrest.com - Port:
21 - Username:
[email protected] - Password:
9yXQ39wz(uL+
Targets
-
-
Target
75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211
-
Size
831KB
-
MD5
46cfa299526c4b456ca0da04d70954dc
-
SHA1
9f66c851d80b921cce5f76533226e6d2d159d448
-
SHA256
75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211
-
SHA512
d0911768b699be59b73a931efcf52af7a5c771541b87425d5759ab63e17e79eb8d22849983affa3ec7abadb10aa488dd3e5479e089b31a0c0f25e83f4ccf74b1
-
SSDEEP
12288:VXH4jhk6ATS3fHfbpKU4ebexSQyD0DMCa7m:Su6AW3fHDpgOdAPaa
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-