General
-
Target
PROFORMA COPY.exe
-
Size
338KB
-
Sample
211022-ds2n2abag3
-
MD5
5936715a6a40ec84592e71ccfdfc1daa
-
SHA1
380440d5690a8ed799138022a7b7678c0323c2bb
-
SHA256
3509582c5fa8e6a4cc257c72e67eec511a90790a60185bce44303fc2c39be80c
-
SHA512
d6610529fd75087bee83fc33cbc57ba1ae1ce81ab4c8e98e57b1d0b7b489cc6116db3bc6c58bc5b9c8a906d41da05305a77d90db989f0e375006fb9c42de032b
Static task
static1
Behavioral task
behavioral1
Sample
PROFORMA COPY.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
PROFORMA COPY.exe
Resource
win10-en-20211014
Malware Config
Targets
-
-
Target
PROFORMA COPY.exe
-
Size
338KB
-
MD5
5936715a6a40ec84592e71ccfdfc1daa
-
SHA1
380440d5690a8ed799138022a7b7678c0323c2bb
-
SHA256
3509582c5fa8e6a4cc257c72e67eec511a90790a60185bce44303fc2c39be80c
-
SHA512
d6610529fd75087bee83fc33cbc57ba1ae1ce81ab4c8e98e57b1d0b7b489cc6116db3bc6c58bc5b9c8a906d41da05305a77d90db989f0e375006fb9c42de032b
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-