General
-
Target
c30b63c938d5090eb132563774378154a0e97f2470f331e904fc023766dd2700
-
Size
1.2MB
-
Sample
240522-hvd3zaff85
-
MD5
9ef77cc57cbe09118edc18409769d299
-
SHA1
a71ac225e5811bc8a72298cf4f2981d10d7dc730
-
SHA256
c30b63c938d5090eb132563774378154a0e97f2470f331e904fc023766dd2700
-
SHA512
c9cb9c026522037d9278afe1fe49f034b323feaa664ff691f8df63045a017f7a56cbca7b6bb35e61e23e1a3a7e56267fa4817ac6e8fb18c6243bffcd06d88cad
-
SSDEEP
24576:tqDEvCTbMWu7rQYlBQcBiT6rprG8aq7hR42K2BjNT8sjwNX:tTvC/MTQYxsWR7aq7hjDjl6
Malware Config
Targets
-
-
Target
c30b63c938d5090eb132563774378154a0e97f2470f331e904fc023766dd2700
-
Size
1.2MB
-
MD5
9ef77cc57cbe09118edc18409769d299
-
SHA1
a71ac225e5811bc8a72298cf4f2981d10d7dc730
-
SHA256
c30b63c938d5090eb132563774378154a0e97f2470f331e904fc023766dd2700
-
SHA512
c9cb9c026522037d9278afe1fe49f034b323feaa664ff691f8df63045a017f7a56cbca7b6bb35e61e23e1a3a7e56267fa4817ac6e8fb18c6243bffcd06d88cad
-
SSDEEP
24576:tqDEvCTbMWu7rQYlBQcBiT6rprG8aq7hR42K2BjNT8sjwNX:tTvC/MTQYxsWR7aq7hjDjl6
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
-
Detects executables referencing Windows vault credential objects. Observed in infostealers
-
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
-
Detects executables referencing many email and collaboration clients. Observed in information stealers
-
Detects executables referencing many file transfer clients. Observed in information stealers
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-