General
-
Target
caa2f58aaa8d47fefd6576268bded1cc8a5a834ce372b1bc0c32aaf1f3cc8033
-
Size
915KB
-
Sample
240604-bywnvshd64
-
MD5
17746c920e5fc164751053c56ae4ad3f
-
SHA1
6d608752627347d0d061cee5c2b3c15eecf9b8ff
-
SHA256
caa2f58aaa8d47fefd6576268bded1cc8a5a834ce372b1bc0c32aaf1f3cc8033
-
SHA512
749baa6fbd66628c00ea55030ffaf80ee9dcd86ca28fd0c3b4c6c46500a31df85c4813e273193e6a133f90e22ce4d45d8cf2fd8b65f7545054005c0aaac1b629
-
SSDEEP
12288:ohX0D9CQStfAheg7w2PUXWkdzyeNaoURCReJKv0+OOt8PYuTBL2s7k78mqS7Dd/c:K0DUY7TsfdHaoUR818CyPYKjmqS/Ql
Static task
static1
Behavioral task
behavioral1
Sample
caa2f58aaa8d47fefd6576268bded1cc8a5a834ce372b1bc0c32aaf1f3cc8033.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
caa2f58aaa8d47fefd6576268bded1cc8a5a834ce372b1bc0c32aaf1f3cc8033.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://edalatianco.com - Port:
21 - Username:
[email protected] - Password:
PLAYBOY@123
Targets
-
-
Target
caa2f58aaa8d47fefd6576268bded1cc8a5a834ce372b1bc0c32aaf1f3cc8033
-
Size
915KB
-
MD5
17746c920e5fc164751053c56ae4ad3f
-
SHA1
6d608752627347d0d061cee5c2b3c15eecf9b8ff
-
SHA256
caa2f58aaa8d47fefd6576268bded1cc8a5a834ce372b1bc0c32aaf1f3cc8033
-
SHA512
749baa6fbd66628c00ea55030ffaf80ee9dcd86ca28fd0c3b4c6c46500a31df85c4813e273193e6a133f90e22ce4d45d8cf2fd8b65f7545054005c0aaac1b629
-
SSDEEP
12288:ohX0D9CQStfAheg7w2PUXWkdzyeNaoURCReJKv0+OOt8PYuTBL2s7k78mqS7Dd/c:K0DUY7TsfdHaoUR818CyPYKjmqS/Ql
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-