General
-
Target
77793cef16432f28d2d3e6f74c1399ae0c523f65a8a96e8eb2a642b5ccc8fca1
-
Size
653KB
-
Sample
240430-bq89zsgf4s
-
MD5
176fbf98df2312dcee84ea5f65e3b98a
-
SHA1
283d66fe4f4b92b2b0025d676426c2781a152f5a
-
SHA256
77793cef16432f28d2d3e6f74c1399ae0c523f65a8a96e8eb2a642b5ccc8fca1
-
SHA512
60688d58d421467ad57262d14397bc574a26b4fa6ed3d95cd8ebe9e8185c85b882b9b317199e5e6edc054943675b5ee7a9ddf6ba231009c5b82b62c31d656e4e
-
SSDEEP
12288:Lq9B778QmWhl1WwU7HvLnHbtlFAjz0DcDqGOV/DG+gZJSYCQJsD:G9BEQ1W7PLHb2jzdDqGONKV+L
Static task
static1
Behavioral task
behavioral1
Sample
77793cef16432f28d2d3e6f74c1399ae0c523f65a8a96e8eb2a642b5ccc8fca1.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
77793cef16432f28d2d3e6f74c1399ae0c523f65a8a96e8eb2a642b5ccc8fca1.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://beirutrest.com - Port:
21 - Username:
[email protected] - Password:
9yXQ39wz(uL+
Extracted
Protocol: ftp- Host:
beirutrest.com - Port:
21 - Username:
[email protected] - Password:
9yXQ39wz(uL+
Targets
-
-
Target
77793cef16432f28d2d3e6f74c1399ae0c523f65a8a96e8eb2a642b5ccc8fca1
-
Size
653KB
-
MD5
176fbf98df2312dcee84ea5f65e3b98a
-
SHA1
283d66fe4f4b92b2b0025d676426c2781a152f5a
-
SHA256
77793cef16432f28d2d3e6f74c1399ae0c523f65a8a96e8eb2a642b5ccc8fca1
-
SHA512
60688d58d421467ad57262d14397bc574a26b4fa6ed3d95cd8ebe9e8185c85b882b9b317199e5e6edc054943675b5ee7a9ddf6ba231009c5b82b62c31d656e4e
-
SSDEEP
12288:Lq9B778QmWhl1WwU7HvLnHbtlFAjz0DcDqGOV/DG+gZJSYCQJsD:G9BEQ1W7PLHb2jzdDqGONKV+L
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-