General
-
Target
pedido 24-NARC-00248.exe
-
Size
675KB
-
Sample
240429-lesg7sfb75
-
MD5
14e65321e8e87acf51a04209b59d575d
-
SHA1
5bf2b65f5aa56a16cbe5c6c551ed7a6cabb4f2cb
-
SHA256
fc87539e22a02272651741ae48f23ce39f83be4f282cf923f22d3aa58500d76b
-
SHA512
f97125ffd012a7f3647323055dc2ed418f12d09b6d0fd2ac6204b462b9a1fd1c63da523a3510359eef926f4a0f283b23d8c600f1a602c83ef30cca1db806ffed
-
SSDEEP
12288:3Olv312Z3Rv0n3HbZe7rA6LDP8W9ptv/C5CpOEHdoDcvuHqWKQS38vYZ:3OJ312ZRv23bZucQDfXCMXGCoqHQU8va
Static task
static1
Behavioral task
behavioral1
Sample
pedido 24-NARC-00248.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
pedido 24-NARC-00248.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.indra-precision.co.th - Port:
21 - Username:
[email protected] - Password:
UW8f$y[fBOEs
Targets
-
-
Target
pedido 24-NARC-00248.exe
-
Size
675KB
-
MD5
14e65321e8e87acf51a04209b59d575d
-
SHA1
5bf2b65f5aa56a16cbe5c6c551ed7a6cabb4f2cb
-
SHA256
fc87539e22a02272651741ae48f23ce39f83be4f282cf923f22d3aa58500d76b
-
SHA512
f97125ffd012a7f3647323055dc2ed418f12d09b6d0fd2ac6204b462b9a1fd1c63da523a3510359eef926f4a0f283b23d8c600f1a602c83ef30cca1db806ffed
-
SSDEEP
12288:3Olv312Z3Rv0n3HbZe7rA6LDP8W9ptv/C5CpOEHdoDcvuHqWKQS38vYZ:3OJ312ZRv23bZucQDfXCMXGCoqHQU8va
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-