General
-
Target
b987ae03e873b8b5f1e4b9c26a8401d3.bin
-
Size
789KB
-
Sample
240613-cplmzavbkr
-
MD5
4c4c6c814683f891a25624549a80a96d
-
SHA1
c8c8826faf415d2ced88570d6e4ab202e8ca217a
-
SHA256
90a250a9daaf0efe55cde73c6d05bf97c69e536e888b56d4564629c2e0ee242f
-
SHA512
73d2856782c780ced8506e9d42e86f44f7d0c3665c5c63e06573f7efac7e4fcee62d1b131fd67fe932c959b8bc4c0b83e42c5de417caed02bd3b1874b75577ab
-
SSDEEP
24576:vLMy5J2g+F71q6RWN3ZAbMJO6oVJkOCACzFqdv/6DH1:voM2R8NOmOqwd6j1
Malware Config
Targets
-
-
Target
b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
-
Size
1.2MB
-
MD5
b987ae03e873b8b5f1e4b9c26a8401d3
-
SHA1
002d164dca14a55455f5d69965e1f26c3fecffa6
-
SHA256
b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106
-
SHA512
852a07423d7b1f268a6473c375d7f6183ae5b12cfe6044c1d0b7389029a7a423fec3242ef5ecca96d9beb76699aba729f4f3f9b8c2affb4c52e16edc721da70a
-
SSDEEP
24576:WAHnh+eWsN3skA4RV1Hom2KXMmHaVdH5C0Mm307Tz2jo649m45:xh+ZkldoPK8YaVJmm32z2x49t
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-