General
-
Target
60ea13ca5f6f7c00c959c098387a8d6a9425f2498ec02ad4d66a856f01acc34d
-
Size
666KB
-
Sample
240523-ceagyshf41
-
MD5
8b67eaaa3b2743e270b215364a52f304
-
SHA1
71ce337b39795fae99bd7ffa0d86a9018646b1cc
-
SHA256
60ea13ca5f6f7c00c959c098387a8d6a9425f2498ec02ad4d66a856f01acc34d
-
SHA512
8c18a08130420e9273f83636fa9d742fd63ca99fc7210e4ed95c0fc4a13c046b6290c3af5da31e2680324793a1bce0f291f080a5b8a164db3a27058aa3ffccfe
-
SSDEEP
12288:F1BYvTv5zLTIkO9X82Y3f6D+V3CTlTH8RpCQxaPrZ/43hr1OpH5D0:FovT1/IR9+PuQc+txKR4OpH5
Static task
static1
Behavioral task
behavioral1
Sample
60ea13ca5f6f7c00c959c098387a8d6a9425f2498ec02ad4d66a856f01acc34d.exe
Resource
win7-20240508-en
Malware Config
Extracted
Protocol: ftp- Host:
eu-west-1.sftpcloud.io - Port:
21 - Username:
e8a17a253c4d40b6a0df898aad32f67b - Password:
RugFalv5wDyjeLFrWC25Q2kWCAS6XObb
Extracted
agenttesla
Protocol: ftp- Host:
ftp://eu-west-1.sftpcloud.io - Port:
21 - Username:
e8a17a253c4d40b6a0df898aad32f67b - Password:
RugFalv5wDyjeLFrWC25Q2kWCAS6XObb
Targets
-
-
Target
60ea13ca5f6f7c00c959c098387a8d6a9425f2498ec02ad4d66a856f01acc34d
-
Size
666KB
-
MD5
8b67eaaa3b2743e270b215364a52f304
-
SHA1
71ce337b39795fae99bd7ffa0d86a9018646b1cc
-
SHA256
60ea13ca5f6f7c00c959c098387a8d6a9425f2498ec02ad4d66a856f01acc34d
-
SHA512
8c18a08130420e9273f83636fa9d742fd63ca99fc7210e4ed95c0fc4a13c046b6290c3af5da31e2680324793a1bce0f291f080a5b8a164db3a27058aa3ffccfe
-
SSDEEP
12288:F1BYvTv5zLTIkO9X82Y3f6D+V3CTlTH8RpCQxaPrZ/43hr1OpH5D0:FovT1/IR9+PuQc+txKR4OpH5
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-