General
-
Target
d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f
-
Size
1.1MB
-
Sample
240727-blt99szfmf
-
MD5
fe9e13e6699fea31c8924575f766fdab
-
SHA1
7f8f162c4edfe354e1e8c364e7fce9822a4b163c
-
SHA256
d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f
-
SHA512
b0df79cbedcba128b257afbc422217176bf6fb2555b65f931bdbd93421d10afceb856b564431f397e8eb23047cf1031e2d9b68f7188c0942738c095ede3b8ea6
-
SSDEEP
24576:0qDEvCTbMWu7rQYlBQcBiT6rprG8avKumalX8f:0TvC/MTQYxsWR7avsgX8
Static task
static1
Behavioral task
behavioral1
Sample
d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.antoniomayol.com:21 - Port:
21 - Username:
[email protected] - Password:
cMhKDQUk1{;%
Targets
-
-
Target
d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f
-
Size
1.1MB
-
MD5
fe9e13e6699fea31c8924575f766fdab
-
SHA1
7f8f162c4edfe354e1e8c364e7fce9822a4b163c
-
SHA256
d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f
-
SHA512
b0df79cbedcba128b257afbc422217176bf6fb2555b65f931bdbd93421d10afceb856b564431f397e8eb23047cf1031e2d9b68f7188c0942738c095ede3b8ea6
-
SSDEEP
24576:0qDEvCTbMWu7rQYlBQcBiT6rprG8avKumalX8f:0TvC/MTQYxsWR7avsgX8
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-