General
-
Target
92c492_959babd593ed4cd49dd3b6a0f1146d59.ps1
-
Size
355KB
-
Sample
211018-mm9l5aechm
-
MD5
20155e92f6a7a7763994226e11713552
-
SHA1
40924207e867cf348592997149b3c4c09218913b
-
SHA256
efe702eff8b1684d9a92b1a5f24e1f375033dd124e588ee30cc778adc16d76f1
-
SHA512
593cdb29c24e72818603dfbe367db4e85a6e5750309658cda0b3443b2b4a65188a51f83bac20089095cdd1400d032be1fa33937d52aeaaf468d53df834559191
Static task
static1
Behavioral task
behavioral1
Sample
92c492_959babd593ed4cd49dd3b6a0f1146d59.ps1
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
92c492_959babd593ed4cd49dd3b6a0f1146d59.ps1
Resource
win10-en-20211014
Malware Config
Targets
-
-
Target
92c492_959babd593ed4cd49dd3b6a0f1146d59.ps1
-
Size
355KB
-
MD5
20155e92f6a7a7763994226e11713552
-
SHA1
40924207e867cf348592997149b3c4c09218913b
-
SHA256
efe702eff8b1684d9a92b1a5f24e1f375033dd124e588ee30cc778adc16d76f1
-
SHA512
593cdb29c24e72818603dfbe367db4e85a6e5750309658cda0b3443b2b4a65188a51f83bac20089095cdd1400d032be1fa33937d52aeaaf468d53df834559191
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-