General
-
Target
c89c48dfcc59f68ba6ec4e17b4736b6325f6c14dd21365e4f9cddeb25d04185d
-
Size
684KB
-
Sample
240426-bkmtssgg76
-
MD5
224e7fb68da8d134c7a2fd771b630b84
-
SHA1
9809da4f903a67ae35cadf7abcee77d5e3d4029f
-
SHA256
c89c48dfcc59f68ba6ec4e17b4736b6325f6c14dd21365e4f9cddeb25d04185d
-
SHA512
94dbcd962bb850b8ccbfbe21eeff8bbb13fd059e44eb5f738b7efcf0f51098d209ce808855b414b3ea344e4f23351cbcdded1ca082e2c817af343d56196d2727
-
SSDEEP
12288:JsJTENl3e49Bwd7t46TbSs6WJUZddOttYxS5zfLl1q2pVDrSlBHlRk:CxENluztpTms6WJedd2tYxS9fLlE2pVt
Static task
static1
Behavioral task
behavioral1
Sample
c89c48dfcc59f68ba6ec4e17b4736b6325f6c14dd21365e4f9cddeb25d04185d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
c89c48dfcc59f68ba6ec4e17b4736b6325f6c14dd21365e4f9cddeb25d04185d.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5902907323:AAGfVK1Q9wMqUU6PhRCwJNTRaKY2lrcdVjY/
Targets
-
-
Target
c89c48dfcc59f68ba6ec4e17b4736b6325f6c14dd21365e4f9cddeb25d04185d
-
Size
684KB
-
MD5
224e7fb68da8d134c7a2fd771b630b84
-
SHA1
9809da4f903a67ae35cadf7abcee77d5e3d4029f
-
SHA256
c89c48dfcc59f68ba6ec4e17b4736b6325f6c14dd21365e4f9cddeb25d04185d
-
SHA512
94dbcd962bb850b8ccbfbe21eeff8bbb13fd059e44eb5f738b7efcf0f51098d209ce808855b414b3ea344e4f23351cbcdded1ca082e2c817af343d56196d2727
-
SSDEEP
12288:JsJTENl3e49Bwd7t46TbSs6WJUZddOttYxS5zfLl1q2pVDrSlBHlRk:CxENluztpTms6WJedd2tYxS9fLlE2pVt
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1