General
-
Target
bf2117027a187100dc80baf714dac0341c8f18fdd5e562248c43685ac0ceca29
-
Size
670KB
-
Sample
240523-cat1sshf29
-
MD5
ed3815b037a3f57bfc35bc4b6c97c3a4
-
SHA1
034cded1a5c78337d11a3b4a0f9b62c270b51862
-
SHA256
bf2117027a187100dc80baf714dac0341c8f18fdd5e562248c43685ac0ceca29
-
SHA512
35a733c79702faf74ffed972eb2e2aef139713a4306634c4f3adb9ca6f9667442af24113efb23e1289ab66d64f02ce56e2406d3df98a52806a63ae90321b11ca
-
SSDEEP
12288:e8EMgXHfAhdhdSsLjQ05GzUPCLDMtUNGQeLq06ShFVr1KFABkeXOaId:e8jgvAhXfQ05Gz3LDUmnAqYjfXXOaI
Static task
static1
Behavioral task
behavioral1
Sample
bf2117027a187100dc80baf714dac0341c8f18fdd5e562248c43685ac0ceca29.exe
Resource
win7-20231129-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6708321519:AAH9WPgZQN8mlLl2zn6ccUEu4DYMqGCeTcQ/
Targets
-
-
Target
bf2117027a187100dc80baf714dac0341c8f18fdd5e562248c43685ac0ceca29
-
Size
670KB
-
MD5
ed3815b037a3f57bfc35bc4b6c97c3a4
-
SHA1
034cded1a5c78337d11a3b4a0f9b62c270b51862
-
SHA256
bf2117027a187100dc80baf714dac0341c8f18fdd5e562248c43685ac0ceca29
-
SHA512
35a733c79702faf74ffed972eb2e2aef139713a4306634c4f3adb9ca6f9667442af24113efb23e1289ab66d64f02ce56e2406d3df98a52806a63ae90321b11ca
-
SSDEEP
12288:e8EMgXHfAhdhdSsLjQ05GzUPCLDMtUNGQeLq06ShFVr1KFABkeXOaId:e8jgvAhXfQ05Gz3LDUmnAqYjfXXOaI
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-