General
-
Target
c329ec734509a6f149aec3e3a122405b7418010f2a1d93412adb69f80b26ec6b
-
Size
1.1MB
-
Sample
241222-bkmtssxmdm
-
MD5
117a8af5596a5c403fb3c8ef54d3ac62
-
SHA1
f91d47aab797853fc1cd2f0adb747267a60ae66f
-
SHA256
c329ec734509a6f149aec3e3a122405b7418010f2a1d93412adb69f80b26ec6b
-
SHA512
a46a88e3bc5f96ec3c379813a3919434c18303abf2642cd95368c7be168d506bccd694a7724bba69a93129197e7b3edf99311d1c7eb1980f09c610b4334ef74d
-
SSDEEP
24576:SqDEvCTbMWu7rQYlBQcBiT6rprG8aK4AzURwBH5:STvC/MTQYxsWR7aK4AzvJ
Static task
static1
Behavioral task
behavioral1
Sample
c329ec734509a6f149aec3e3a122405b7418010f2a1d93412adb69f80b26ec6b.exe
Resource
win7-20240903-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.elquijotebanquetes.com - Port:
21 - Username:
[email protected] - Password:
-GN,s*KH{VEhPmo)+f
Targets
-
-
Target
c329ec734509a6f149aec3e3a122405b7418010f2a1d93412adb69f80b26ec6b
-
Size
1.1MB
-
MD5
117a8af5596a5c403fb3c8ef54d3ac62
-
SHA1
f91d47aab797853fc1cd2f0adb747267a60ae66f
-
SHA256
c329ec734509a6f149aec3e3a122405b7418010f2a1d93412adb69f80b26ec6b
-
SHA512
a46a88e3bc5f96ec3c379813a3919434c18303abf2642cd95368c7be168d506bccd694a7724bba69a93129197e7b3edf99311d1c7eb1980f09c610b4334ef74d
-
SSDEEP
24576:SqDEvCTbMWu7rQYlBQcBiT6rprG8aK4AzURwBH5:STvC/MTQYxsWR7aK4AzvJ
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-