General
-
Target
05438e3d5f2c2fb2f260405f1d483325d74e21ef7e6a9f59535e72e45caad5ba
-
Size
716KB
-
Sample
240427-bykatsgc44
-
MD5
18b9f67364daef9baabd76428debcfd9
-
SHA1
c21249f8121d6700f84fb9a571e3f35ae94b12fe
-
SHA256
05438e3d5f2c2fb2f260405f1d483325d74e21ef7e6a9f59535e72e45caad5ba
-
SHA512
915ea3e10954140233232f6256388c283001a69eac075de9c3360b5c98b8f58d7da737aa961075ae495c9949da2a7ad3cd299c172834cda216977dd3ee120a93
-
SSDEEP
12288:zWYIPXjxannnHg2x7ZdRv/7Frn78nnnHA+tbHrkQyF2t2r0NASvh75A+9QIGJPLd:zWYIPFannnHg2FRv/7Frn72nnHA+tMQm
Static task
static1
Behavioral task
behavioral1
Sample
05438e3d5f2c2fb2f260405f1d483325d74e21ef7e6a9f59535e72e45caad5ba.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
05438e3d5f2c2fb2f260405f1d483325d74e21ef7e6a9f59535e72e45caad5ba.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6898096162:AAFzf90ZkuQ80ZmTP6HPUBE8_1lQzS4JyCI/
Targets
-
-
Target
05438e3d5f2c2fb2f260405f1d483325d74e21ef7e6a9f59535e72e45caad5ba
-
Size
716KB
-
MD5
18b9f67364daef9baabd76428debcfd9
-
SHA1
c21249f8121d6700f84fb9a571e3f35ae94b12fe
-
SHA256
05438e3d5f2c2fb2f260405f1d483325d74e21ef7e6a9f59535e72e45caad5ba
-
SHA512
915ea3e10954140233232f6256388c283001a69eac075de9c3360b5c98b8f58d7da737aa961075ae495c9949da2a7ad3cd299c172834cda216977dd3ee120a93
-
SSDEEP
12288:zWYIPXjxannnHg2x7ZdRv/7Frn78nnnHA+tbHrkQyF2t2r0NASvh75A+9QIGJPLd:zWYIPFannnHg2FRv/7Frn72nnHA+tMQm
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1