General
-
Target
4753f11e296430bb40e328ad38fe44ecf72aafcdf12cfed22bf16d3f8a0ade34.exe
-
Size
849KB
-
Sample
240919-bnhn9atbla
-
MD5
7e7122557d4dcc0e0e39031aeee97570
-
SHA1
ca1d7c0bd2ae735caa8df2ec50f6afec92b6e565
-
SHA256
4753f11e296430bb40e328ad38fe44ecf72aafcdf12cfed22bf16d3f8a0ade34
-
SHA512
4f74b2fa8f3b6b229c6b3f8c415536452a0501d1d3cda0fe77a9a3e9dde5ee41db44e072c584b9f8f2336b3214cde1a7a6e7d0dff9138212d16ae3aebd4fcf8e
-
SSDEEP
12288:SKlllZcsZ6ahn6JZN08J734IAMdv2+p8HVzzuS+Q3czbWbtb+Ayt+1LmZ3K1K:DcmN6Jj0ibXv2+WD+Qeb0YAO+1W3K1K
Static task
static1
Behavioral task
behavioral1
Sample
4753f11e296430bb40e328ad38fe44ecf72aafcdf12cfed22bf16d3f8a0ade34.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4753f11e296430bb40e328ad38fe44ecf72aafcdf12cfed22bf16d3f8a0ade34.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://inhanoi.net.vn - Port:
21 - Username:
[email protected] - Password:
^TSt3!FK$UBA
Targets
-
-
Target
4753f11e296430bb40e328ad38fe44ecf72aafcdf12cfed22bf16d3f8a0ade34.exe
-
Size
849KB
-
MD5
7e7122557d4dcc0e0e39031aeee97570
-
SHA1
ca1d7c0bd2ae735caa8df2ec50f6afec92b6e565
-
SHA256
4753f11e296430bb40e328ad38fe44ecf72aafcdf12cfed22bf16d3f8a0ade34
-
SHA512
4f74b2fa8f3b6b229c6b3f8c415536452a0501d1d3cda0fe77a9a3e9dde5ee41db44e072c584b9f8f2336b3214cde1a7a6e7d0dff9138212d16ae3aebd4fcf8e
-
SSDEEP
12288:SKlllZcsZ6ahn6JZN08J734IAMdv2+p8HVzzuS+Q3czbWbtb+Ayt+1LmZ3K1K:DcmN6Jj0ibXv2+WD+Qeb0YAO+1W3K1K
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-