General
-
Target
822e8ac1653b10c7062998adf7db838bd515dc3cd43047a4d12bc9d2c2080696
-
Size
1005KB
-
Sample
240522-btb4nafh65
-
MD5
257e48b2852805583552ce20132e3c0d
-
SHA1
fad6747e82e6fdd330cf3da35c7d178b30d7a21a
-
SHA256
822e8ac1653b10c7062998adf7db838bd515dc3cd43047a4d12bc9d2c2080696
-
SHA512
b20c6a0c51390f80ad49799967a83ce096e124d6cc4652222a530a36aa7573ad2df078707bf9517969e90896d38dd71710feaf26dd5e35fdcea87efa2c101a32
-
SSDEEP
24576:eAHnh+eWsN3skA4RV1Hom2KXMmHaxGxllnKr8si75:Jh+ZkldoPK8YaxGx7E89
Static task
static1
Behavioral task
behavioral1
Sample
822e8ac1653b10c7062998adf7db838bd515dc3cd43047a4d12bc9d2c2080696.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
822e8ac1653b10c7062998adf7db838bd515dc3cd43047a4d12bc9d2c2080696.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.midhcodistribuciones.com - Port:
21 - Username:
[email protected] - Password:
,A7}+JV4KExQ
Targets
-
-
Target
822e8ac1653b10c7062998adf7db838bd515dc3cd43047a4d12bc9d2c2080696
-
Size
1005KB
-
MD5
257e48b2852805583552ce20132e3c0d
-
SHA1
fad6747e82e6fdd330cf3da35c7d178b30d7a21a
-
SHA256
822e8ac1653b10c7062998adf7db838bd515dc3cd43047a4d12bc9d2c2080696
-
SHA512
b20c6a0c51390f80ad49799967a83ce096e124d6cc4652222a530a36aa7573ad2df078707bf9517969e90896d38dd71710feaf26dd5e35fdcea87efa2c101a32
-
SSDEEP
24576:eAHnh+eWsN3skA4RV1Hom2KXMmHaxGxllnKr8si75:Jh+ZkldoPK8YaxGx7E89
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-