General
-
Target
aeb4930ba6ea074bf02c7c2cda14a45a4808ea4dabe94f575565563db5f9eedc
-
Size
1011KB
-
Sample
240523-byds2sgg2t
-
MD5
bde767eb7827a982f151740342dbf833
-
SHA1
c31b1c748ce78966fb4df41463cae7eef2d186ce
-
SHA256
aeb4930ba6ea074bf02c7c2cda14a45a4808ea4dabe94f575565563db5f9eedc
-
SHA512
f6ca00f8d816ecdeb470c74bd05e08ae1ffaaa931d2360180c65e81663a0cc0d3de9c7f9a019a4bfb8067052d70bbe18e068720fcaada84887177b9ceb588e7d
-
SSDEEP
24576:McAHnh+eWsN3skA4RV1Hom2KXMmHaSOejFO6pWmjC5:4h+ZkldoPK8YaSOwFO6p9k
Static task
static1
Behavioral task
behavioral1
Sample
aeb4930ba6ea074bf02c7c2cda14a45a4808ea4dabe94f575565563db5f9eedc.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
aeb4930ba6ea074bf02c7c2cda14a45a4808ea4dabe94f575565563db5f9eedc.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.ultraflex.com.mx - Port:
21 - Username:
[email protected] - Password:
Jgj8-p4Z]a1b
Targets
-
-
Target
aeb4930ba6ea074bf02c7c2cda14a45a4808ea4dabe94f575565563db5f9eedc
-
Size
1011KB
-
MD5
bde767eb7827a982f151740342dbf833
-
SHA1
c31b1c748ce78966fb4df41463cae7eef2d186ce
-
SHA256
aeb4930ba6ea074bf02c7c2cda14a45a4808ea4dabe94f575565563db5f9eedc
-
SHA512
f6ca00f8d816ecdeb470c74bd05e08ae1ffaaa931d2360180c65e81663a0cc0d3de9c7f9a019a4bfb8067052d70bbe18e068720fcaada84887177b9ceb588e7d
-
SSDEEP
24576:McAHnh+eWsN3skA4RV1Hom2KXMmHaSOejFO6pWmjC5:4h+ZkldoPK8YaSOwFO6p9k
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-