General
-
Target
583d0b9635cce2701511a507937c16e0b3c398d18da99920cbaca025245ebd2f
-
Size
716KB
-
Sample
240522-caynzsgg7x
-
MD5
3f3eebbdbec1db7808000dca7e79c425
-
SHA1
96b7a58023d84714eb7d4ec5f3b2a115b957d3dd
-
SHA256
583d0b9635cce2701511a507937c16e0b3c398d18da99920cbaca025245ebd2f
-
SHA512
1e4025ac54042ffef0d960939490c1f60223e431cb99893cffce685a891b38563e19cd289583278b19704576f0bceb8bf6b2b28c107f160af0bf35099aee882d
-
SSDEEP
12288:16S01AY8zLYLW81dKC2EcZxMs5q2LdZiRxzG/uApnbCeV4dHJ7jV/SH:YOHzLY1dKsckmqqdZi/GjbCeWNFMH
Static task
static1
Behavioral task
behavioral1
Sample
583d0b9635cce2701511a507937c16e0b3c398d18da99920cbaca025245ebd2f.exe
Resource
win7-20240221-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot7015664985:AAHleki-SQmw3JzMgY4JBxs1efeJOxHCF7A/
Targets
-
-
Target
583d0b9635cce2701511a507937c16e0b3c398d18da99920cbaca025245ebd2f
-
Size
716KB
-
MD5
3f3eebbdbec1db7808000dca7e79c425
-
SHA1
96b7a58023d84714eb7d4ec5f3b2a115b957d3dd
-
SHA256
583d0b9635cce2701511a507937c16e0b3c398d18da99920cbaca025245ebd2f
-
SHA512
1e4025ac54042ffef0d960939490c1f60223e431cb99893cffce685a891b38563e19cd289583278b19704576f0bceb8bf6b2b28c107f160af0bf35099aee882d
-
SSDEEP
12288:16S01AY8zLYLW81dKC2EcZxMs5q2LdZiRxzG/uApnbCeV4dHJ7jV/SH:YOHzLY1dKsckmqqdZi/GjbCeWNFMH
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-