General
-
Target
0b801481f7062a60c4167729e03d45d605b766d368a5f13efc6906558ad60f28
-
Size
965KB
-
Sample
240430-bzh46aha3y
-
MD5
6ef956ed9f5e1ff71a1e484902a6d1a5
-
SHA1
f361053480e94e0142a0b8fc81b96c399da81861
-
SHA256
0b801481f7062a60c4167729e03d45d605b766d368a5f13efc6906558ad60f28
-
SHA512
e7f40cb828e522f22ef412bdca59a2663da81660f26efce5ff73a35b00071039a2b7f7b18a885710b9b9658b4a25af6f8f064415c3397ad6e6b540dda7db5f37
-
SSDEEP
24576:Jj3+BMwzZcbT/JYjPtfjhEJgL7Fy5wR0D2QAN:EOwzZAT2jPtJj0DHAN
Static task
static1
Behavioral task
behavioral1
Sample
0b801481f7062a60c4167729e03d45d605b766d368a5f13efc6906558ad60f28.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0b801481f7062a60c4167729e03d45d605b766d368a5f13efc6906558ad60f28.exe
Resource
win10v2004-20240419-en
Malware Config
Targets
-
-
Target
0b801481f7062a60c4167729e03d45d605b766d368a5f13efc6906558ad60f28
-
Size
965KB
-
MD5
6ef956ed9f5e1ff71a1e484902a6d1a5
-
SHA1
f361053480e94e0142a0b8fc81b96c399da81861
-
SHA256
0b801481f7062a60c4167729e03d45d605b766d368a5f13efc6906558ad60f28
-
SHA512
e7f40cb828e522f22ef412bdca59a2663da81660f26efce5ff73a35b00071039a2b7f7b18a885710b9b9658b4a25af6f8f064415c3397ad6e6b540dda7db5f37
-
SSDEEP
24576:Jj3+BMwzZcbT/JYjPtfjhEJgL7Fy5wR0D2QAN:EOwzZAT2jPtJj0DHAN
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-