General
-
Target
bf8fb3b88d40bcf605f71c1cdc2b41c3c605016d3a846598ab8e7ea6ef28689b
-
Size
247KB
-
Sample
240619-cxt93swgkr
-
MD5
523bd0c71471dbc752e286837c43e43b
-
SHA1
9ec6042749e1d68ccff3b47cd588d25a76c6ae0d
-
SHA256
bf8fb3b88d40bcf605f71c1cdc2b41c3c605016d3a846598ab8e7ea6ef28689b
-
SHA512
f4ff8ccce20dbb365ebbdd75df7c48a353fa02b1c8326398144d4b0a3319cd7163fa50a4f4c7e469eba18ed929060232a35fbaf13fdd2e88d8bad9cdf3665178
-
SSDEEP
3072:FpcHgMwEQr8VbwU8HQyUJ6lxHZpe3STcxc95Mf6Eh5S/ESn:FOHgMwEQr8VbwU8HQyUJoHzVwKkiEhc
Behavioral task
behavioral1
Sample
bf8fb3b88d40bcf605f71c1cdc2b41c3c605016d3a846598ab8e7ea6ef28689b.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
bf8fb3b88d40bcf605f71c1cdc2b41c3c605016d3a846598ab8e7ea6ef28689b.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6452948293:AAEZRz229ndUOqSnENvtLZ7bQLaB0zuKIEY/
Targets
-
-
Target
bf8fb3b88d40bcf605f71c1cdc2b41c3c605016d3a846598ab8e7ea6ef28689b
-
Size
247KB
-
MD5
523bd0c71471dbc752e286837c43e43b
-
SHA1
9ec6042749e1d68ccff3b47cd588d25a76c6ae0d
-
SHA256
bf8fb3b88d40bcf605f71c1cdc2b41c3c605016d3a846598ab8e7ea6ef28689b
-
SHA512
f4ff8ccce20dbb365ebbdd75df7c48a353fa02b1c8326398144d4b0a3319cd7163fa50a4f4c7e469eba18ed929060232a35fbaf13fdd2e88d8bad9cdf3665178
-
SSDEEP
3072:FpcHgMwEQr8VbwU8HQyUJ6lxHZpe3STcxc95Mf6Eh5S/ESn:FOHgMwEQr8VbwU8HQyUJoHzVwKkiEhc
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-