General
-
Target
19092024_0650_Image_001.vbs.zip
-
Size
182KB
-
Sample
240919-hl2gxawdmn
-
MD5
71c4c568734a6f8d1f6a198b5f7f87f2
-
SHA1
232c6a6b2e0af6c65d860acceaa0eebec531ca58
-
SHA256
850e04f732c4bfbbc9be64efd835b5bbcedb83854427946611ca19aeaffeaa27
-
SHA512
27fb0e516799c3a3161b66a3c5179cb0b9a976b9a0e76379fe35df62e8a8998b0cf6bc1b44f4491fb814853722ec39a763ab522c41c84c0a1f38ab046babdb15
-
SSDEEP
3072:FUI8+ODuT11yEcyEjZtAEmhovozc4U7xiYymAWT/Vk6RicqG8T1tEh9sOUIdKEr:Fb8uHyEcTjZuEZAzvU7x4v6RiO8nEhVl
Static task
static1
Behavioral task
behavioral1
Sample
Image_001.vbs
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Image_001.vbs
Resource
win10v2004-20240802-en
Malware Config
Extracted
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt
Extracted
agenttesla
https://api.telegram.org/bot6852245174:AAHgk_9s-tH6YNacTaCnQz56uJMggI0fZDw/
Targets
-
-
Target
Image_001.vbs
-
Size
507KB
-
MD5
369b2913abd7a1e2ecfeea185e737e61
-
SHA1
eb9431fc12b373c216e2c89af2cfdafdc5dae727
-
SHA256
8264386f0b6a0e9b2aa5f908dc3909f4b8a61b619edb269baf56bf7112ae100e
-
SHA512
e6e02f36641a087c1e437885c1b432e325f6b805ba371093302092912065515efe090121ea54f432ea6e23c466a44635c426efbaad2268cf03c251b0657f8f9b
-
SSDEEP
12288:bsD8YhlqjFf0pIWLNvd5/iaPr4/Is0en9sAWxihGmxLyKSHPh72RwsZIohgrVVMA:jcj6whXoTMA0t
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-