General
-
Target
2ca2fbe622298ea0358a8fc7c7a4735d5b4288c5d4e9a5af2211f826042eb81d
-
Size
647KB
-
Sample
240913-k4dvnswbng
-
MD5
ce2416941a49a6a759beedb2bc748e3a
-
SHA1
2924956f665d9cc1aaddcb15d4058f612cf385ca
-
SHA256
2ca2fbe622298ea0358a8fc7c7a4735d5b4288c5d4e9a5af2211f826042eb81d
-
SHA512
634081c961ecc3cd1312ad6518b27eb6d74a93732c20b00d0ba14326a9017fa311d32a45466b949243ec4e6c49e28778d725bb04344dca2a41832da1c8747ede
-
SSDEEP
12288:np9PQZJcp+vbC2PRg6FUmXOIB5IAXDiDE7qXzr/D+iO6gAOkNpeihlH:nTQQp+vbCOCWHOInIsDqEEHadLAOkN9Z
Static task
static1
Behavioral task
behavioral1
Sample
c40c36978fc01bcbd7eca78bb7b5689b7460bbe7ef122cc2a2cde6fc415d24e0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c40c36978fc01bcbd7eca78bb7b5689b7460bbe7ef122cc2a2cde6fc415d24e0.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.stingatoareincendii.ro - Port:
21 - Username:
[email protected] - Password:
3.*RYhlG)lkA
Targets
-
-
Target
c40c36978fc01bcbd7eca78bb7b5689b7460bbe7ef122cc2a2cde6fc415d24e0.exe
-
Size
1.0MB
-
MD5
cf702544b48bbe770375eb7188464eb8
-
SHA1
d19daad1628bccb94b5e5cbea08310231def8d99
-
SHA256
c40c36978fc01bcbd7eca78bb7b5689b7460bbe7ef122cc2a2cde6fc415d24e0
-
SHA512
0461297a310f67479c6d9195c25ea4559728b7ac78d3120dc689511373880a2800cef45b960b7d4b5fd23b87c0254ef7e139197d12e0af55b6b07759c9822192
-
SSDEEP
24576:Q4lavt0LkLL9IMixoEgeadFnfJgV3q9MmCS:Hkwkn9IMHeadpRgpaPCS
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-