General
-
Target
bnn.exe
-
Size
1.1MB
-
Sample
240120-sbmacabgfm
-
MD5
a75a9fe738f5b6b2b34daf99fef72cf5
-
SHA1
4e93be3a205b7c085efb0b79fd92103bf4dce15f
-
SHA256
370e02c2619bd47c427f97881eafc89167f58084e9f41c9d9edc81318180d405
-
SHA512
c118daa3f26e08464333a3f0db9fda9fd7d31df854e3a1e032e4da1b70e5e113fb2de96ddc7c6b5ecdb96cd52d7cccfcdeec7f79de9c71f36c76378a322804a3
-
SSDEEP
24576:9qDEvCTbMWu7rQYlBQcBiT6rprG8aZCsPgMrg:9TvC/MTQYxsWR7aZCs
Static task
static1
Behavioral task
behavioral1
Sample
bnn.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
bnn.exe
Resource
win10v2004-20231222-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6036191007:AAG666CvGTNytMyFGIeVwbtc7GwGgBSmgOE/
Targets
-
-
Target
bnn.exe
-
Size
1.1MB
-
MD5
a75a9fe738f5b6b2b34daf99fef72cf5
-
SHA1
4e93be3a205b7c085efb0b79fd92103bf4dce15f
-
SHA256
370e02c2619bd47c427f97881eafc89167f58084e9f41c9d9edc81318180d405
-
SHA512
c118daa3f26e08464333a3f0db9fda9fd7d31df854e3a1e032e4da1b70e5e113fb2de96ddc7c6b5ecdb96cd52d7cccfcdeec7f79de9c71f36c76378a322804a3
-
SSDEEP
24576:9qDEvCTbMWu7rQYlBQcBiT6rprG8aZCsPgMrg:9TvC/MTQYxsWR7aZCs
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-