General
-
Target
8e280c86100e21e4edc3e5f9b953482bafd65a8f05fdb3e89b150e92a6d6aa5b
-
Size
1.4MB
-
Sample
240604-by1b2shd68
-
MD5
e43e3db18041b206b5bd174ed071805b
-
SHA1
a9c8afc81d0e20fb087a67ba8f7b029eb4e56cd4
-
SHA256
8e280c86100e21e4edc3e5f9b953482bafd65a8f05fdb3e89b150e92a6d6aa5b
-
SHA512
9104cb6d4b2c566c00dd1dceaa934771ace30b79a9611f668e5a3fbc08cd6b5bb82c52701b5379127481272311589065daaa2948fe5a2f51c59c334dd15d534e
-
SSDEEP
12288:hhX0D9CQStfAheg7w2PUXWkdzyeNaoURCReJKv0+OOt8PYuTBL2s7k78mqS7Dd/c:b0DUY7TsfdHaoUR818CyPYKjmqS/Ql
Static task
static1
Behavioral task
behavioral1
Sample
Delivery Note_pdf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Delivery Note_pdf.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://edalatianco.com - Port:
21 - Username:
[email protected] - Password:
PLAYBOY@123
Targets
-
-
Target
Delivery Note_pdf.exe
-
Size
915KB
-
MD5
17746c920e5fc164751053c56ae4ad3f
-
SHA1
6d608752627347d0d061cee5c2b3c15eecf9b8ff
-
SHA256
caa2f58aaa8d47fefd6576268bded1cc8a5a834ce372b1bc0c32aaf1f3cc8033
-
SHA512
749baa6fbd66628c00ea55030ffaf80ee9dcd86ca28fd0c3b4c6c46500a31df85c4813e273193e6a133f90e22ce4d45d8cf2fd8b65f7545054005c0aaac1b629
-
SSDEEP
12288:ohX0D9CQStfAheg7w2PUXWkdzyeNaoURCReJKv0+OOt8PYuTBL2s7k78mqS7Dd/c:K0DUY7TsfdHaoUR818CyPYKjmqS/Ql
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-