General
-
Target
Athens VOYAGE DETAILS.lzh
-
Size
644KB
-
Sample
240522-m9qgrscf53
-
MD5
7d9132f41224b2c30d61708107a6c9a8
-
SHA1
635da3212e87eea9651c7d469ca2ab2722c53964
-
SHA256
6a52b1b5b6485760c7d7e10059b702f31929a413cb0374b2ae66cea369d50c1e
-
SHA512
c5737f2470596dedcb947925fc52a69c6a344e0b44ab70a86e454ce17884672bb3fb58012977df1dbc9920693960570792b1f848b7c607a73a2870b47995fef2
-
SSDEEP
12288:gc9UpWiB9V7GnmxMMiaepOZ80vb8i78r48xHLKrlJU0DRWeyT+MgH:ritfKmxMMGpK3jN58t2rM0DGG
Static task
static1
Behavioral task
behavioral1
Sample
Athens VOYAGE DETAILS.scr
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Athens VOYAGE DETAILS.scr
Resource
win10v2004-20240508-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://beirutrest.com - Port:
21 - Username:
[email protected] - Password:
9yXQ39wz(uL+
Extracted
Protocol: ftp- Host:
beirutrest.com - Port:
21 - Username:
[email protected] - Password:
9yXQ39wz(uL+
Targets
-
-
Target
Athens VOYAGE DETAILS.scr
-
Size
665KB
-
MD5
b51160bbcf48437d66790f228769ce73
-
SHA1
38865f0047aef6afdeff054baf3e6387ddd2b012
-
SHA256
89bd0410a26507a9acbb4d5150b5f284e7a4263ddf65930234d9a3ebddb26da3
-
SHA512
ed8714a3e4f918bf0cb62edfc19300714366e55393b3abbf60f8fd5b439146ceee26b062720238484efc0c240a2ceeadf981abe2f7406bf6b567f871f2acc1bd
-
SSDEEP
12288:Q99RHgaa+nw+eybQ70OD0PdLGv4ZRo0WSJR+/2x8MARET204MK2eyBeg:QxAaa25eybVllLPZW52+MARJ04t
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-