General
-
Target
30052024_1351_27052024_PI-236031.rar
-
Size
522KB
-
Sample
240530-q57f9sag6t
-
MD5
43ba3abf99d3918987d5bdc4ea0a20ba
-
SHA1
4ab0701f1f9f2cad6236f27f27854d89b9d494a9
-
SHA256
544900b78d980d88152cf5f4a6fc92a3752e30890cd2373593b3769f698e07ac
-
SHA512
f098b4cf470e119e3a4ef0dd898aa63154428ebd3a5a91bf6f47b7b740ac76c31b71aa62d283852f2ea590a018626b3ba1f385b03b18837ea116cb189ab9f955
-
SSDEEP
12288:9ZvABoF/oa6Xh0uhG5l2GBx2CXDUIBPYYhu9NZT/YzOIK/3o0:3Ik/o/Xh095l2u4UIQgPNZTATq
Static task
static1
Behavioral task
behavioral1
Sample
PI-236031.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
PI-236031.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.fosna.net - Port:
21 - Username:
[email protected] - Password:
(=8fPSH$KO_!
Targets
-
-
Target
PI-236031.exe
-
Size
1013KB
-
MD5
05d95a552838cb5c6d45a79473c9f430
-
SHA1
535c4d854628081163b1da1afdea892204a88eef
-
SHA256
9f8325d8345d383ed22e18f47303b03947c1e652ad304b7ca88a270355eb8f4d
-
SHA512
4bab7d8da8541f46b7b048838f02c6d7a3408fe4615970375024fc7986bf2dbd790358a4aa2d68deb3a7ebdb4ab55b0bba85b54b390c695da7c645918f3d414c
-
SSDEEP
24576:OAHnh+eWsN3skA4RV1Hom2KXMmHauvhieQkXRGQ5:5h+ZkldoPK8YauikX/
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-