General
-
Target
a560786ce46de50d544c1013f167cc44b3fee86978ab5ebea8124ec57a4d863c
-
Size
1.1MB
-
Sample
240630-aycejstgmp
-
MD5
051d3b2c4154006084188d91e7fddf88
-
SHA1
dfe4054e88fd1cf42f48dc338c43a4f8ba690593
-
SHA256
a560786ce46de50d544c1013f167cc44b3fee86978ab5ebea8124ec57a4d863c
-
SHA512
70577c29b3bb5562b8dda8ad96c3ad4a952506c3616313590ddff403205019c56a5a85fe25745a1725cbedc812c21bbbbe956f3793719c85b873ddbf5bf85f59
-
SSDEEP
24576:0AHnh+eWsN3skA4RV1Hom2KXMmHa3WMxoWVFG8V5:Dh+ZkldoPK8Ya3WsoYFG+
Malware Config
Targets
-
-
Target
a560786ce46de50d544c1013f167cc44b3fee86978ab5ebea8124ec57a4d863c
-
Size
1.1MB
-
MD5
051d3b2c4154006084188d91e7fddf88
-
SHA1
dfe4054e88fd1cf42f48dc338c43a4f8ba690593
-
SHA256
a560786ce46de50d544c1013f167cc44b3fee86978ab5ebea8124ec57a4d863c
-
SHA512
70577c29b3bb5562b8dda8ad96c3ad4a952506c3616313590ddff403205019c56a5a85fe25745a1725cbedc812c21bbbbe956f3793719c85b873ddbf5bf85f59
-
SSDEEP
24576:0AHnh+eWsN3skA4RV1Hom2KXMmHa3WMxoWVFG8V5:Dh+ZkldoPK8Ya3WsoYFG+
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects executables referencing Windows vault credential objects. Observed in infostealers
-
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
-
Detects executables referencing many email and collaboration clients. Observed in information stealers
-
Detects executables referencing many file transfer clients. Observed in information stealers
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-