General
-
Target
zNHdzFVZNFvIrv.exe
-
Size
185KB
-
Sample
240429-srynbaeb9t
-
MD5
327a06376dce413bf108947bd6707b18
-
SHA1
37e8f9310c342957b1cc2b6257962eea8e065567
-
SHA256
5c5129fb75c6338317e77860ac1b31739dd72160d5c3f24e3e48e92324196cc4
-
SHA512
9be8155857c7a3a3cea9567e3a7c5e87656c3f9240e5dcc269552829518919024ca2411dbd85a9926c264e2597b45ff7583d0b4829613c6390510aae46cb8546
-
SSDEEP
3072:6iu4ZVMK/uJlYT86knnt7i+KMj6GCqOXVSBvxgxd:m+HO2knntr6COABvxy
Static task
static1
Behavioral task
behavioral1
Sample
zNHdzFVZNFvIrv.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
zNHdzFVZNFvIrv.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot7065540472:AAGCgWd34zCLUmYGAqhTqJZxzQOf9gQ2bpg/
Targets
-
-
Target
zNHdzFVZNFvIrv.exe
-
Size
185KB
-
MD5
327a06376dce413bf108947bd6707b18
-
SHA1
37e8f9310c342957b1cc2b6257962eea8e065567
-
SHA256
5c5129fb75c6338317e77860ac1b31739dd72160d5c3f24e3e48e92324196cc4
-
SHA512
9be8155857c7a3a3cea9567e3a7c5e87656c3f9240e5dcc269552829518919024ca2411dbd85a9926c264e2597b45ff7583d0b4829613c6390510aae46cb8546
-
SSDEEP
3072:6iu4ZVMK/uJlYT86knnt7i+KMj6GCqOXVSBvxgxd:m+HO2knntr6COABvxy
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-