General
-
Target
Star Light - Ship's particulars new (2).exe
-
Size
645KB
-
Sample
240123-trclhscfb5
-
MD5
9111819bbea5a62fd2a8b37d7ffd17a0
-
SHA1
ae3077b82eec6695bdd3eb40bcf992517ff6189b
-
SHA256
8826eb70de19f0bde0925ea53e0e33510e5414658ceaf5afacb6c1fb180d9745
-
SHA512
30d3cf8ead66c23856c35c1d050421cf36a787887033c3e75a4bcb09f8136f9329577ec3e688702dff83560153e2eaf02d2cafcebc84e8c77e0c9b2e4e15b1b5
-
SSDEEP
12288:uijLBJI3xIpLBrrC+k0oW0cT39Of5W/AITY8U4l0G5xr4yFLT+qog/ZgE:tjrux6rC+kMT3sfM/PY81br4yFmqo8Zx
Static task
static1
Behavioral task
behavioral1
Sample
Star Light - Ship's particulars new (2).exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Star Light - Ship's particulars new (2).exe
Resource
win10v2004-20231222-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6890953843:AAESDeAPFWFuXjE5oUpLiVkGoZxJQbW2ZFE/
Targets
-
-
Target
Star Light - Ship's particulars new (2).exe
-
Size
645KB
-
MD5
9111819bbea5a62fd2a8b37d7ffd17a0
-
SHA1
ae3077b82eec6695bdd3eb40bcf992517ff6189b
-
SHA256
8826eb70de19f0bde0925ea53e0e33510e5414658ceaf5afacb6c1fb180d9745
-
SHA512
30d3cf8ead66c23856c35c1d050421cf36a787887033c3e75a4bcb09f8136f9329577ec3e688702dff83560153e2eaf02d2cafcebc84e8c77e0c9b2e4e15b1b5
-
SSDEEP
12288:uijLBJI3xIpLBrrC+k0oW0cT39Of5W/AITY8U4l0G5xr4yFLT+qog/ZgE:tjrux6rC+kMT3sfM/PY81br4yFmqo8Zx
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-