General
-
Target
5c6bd84aa0d5aa14ac98f583b3bc53ec09d433c6261b4c6dabcfac4e44aa802f.zip
-
Size
617KB
-
Sample
240618-vkmctawfqq
-
MD5
1649cee761d5d458246fb9d77280ace5
-
SHA1
90c52127bf3cfd025693299c5fcfff6f4877d716
-
SHA256
5c6bd84aa0d5aa14ac98f583b3bc53ec09d433c6261b4c6dabcfac4e44aa802f
-
SHA512
32440cfac5941ee4fb8d67f27afa92f09926ff9a11f06e0d813db51e3f43b46d50e0b8f769695df2c30514052f2923da0ed6c13f2edd0997288af333101a0cb4
-
SSDEEP
12288:VC5k8c5cG/QwOVasP1WoX2DaKZ6IqeUgGIGYlAPwjGPvqyeh6ILfzOWDNafksCfR:VGc+m8VFP1WsugI/GI7APw8VIzzrxAk3
Static task
static1
Behavioral task
behavioral1
Sample
FACTURA09654700.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
FACTURA09654700.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.antoniomayol.com:21 - Port:
21 - Username:
[email protected] - Password:
cMhKDQUk1{;%
Targets
-
-
Target
FACTURA09654700.BAT
-
Size
1.0MB
-
MD5
aed00ff3e85dbf1bbf99939966939b3a
-
SHA1
d02a5bc420207a7958e34a4740968439969f5b19
-
SHA256
b772162c5b510c5427be045abfdc43c29756217e2ed924ce4c4388bd457a4987
-
SHA512
08ad4f11a67a9e8228d83e96fbcccd98910d53ff2929e2d70d336b8e808d4d7e37f90d157e2747b744eb19b451aba2a0985022207a68ff50dcbd8cdef5e1f50a
-
SSDEEP
24576:HAHnh+eWsN3skA4RV1Hom2KXMmHauOVaz7jxokZf4vFEGR5:6h+ZkldoPK8YauOIzHxokZfqFEo
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-