General
-
Target
COVID-19 Emergency.exe
-
Size
610KB
-
Sample
211026-t6kknshhf3
-
MD5
ea4216e97a3007309295e8a7b769208b
-
SHA1
bf86f6614965d6ebd5d2ea10d46780a86b225c44
-
SHA256
7a4b1e5015937985613975df6c4f2046b0398c6e32ea10b780da1cce61ef3d44
-
SHA512
3d13436cfd5ab6db58b017fb7ffa1bfc62cecf9c899a5d880233457f0ac9dd331c37eca300271cdf2ed0cfb6a7e437299861aee3c8635bc33812fbc8830804ff
Static task
static1
Behavioral task
behavioral1
Sample
COVID-19 Emergency.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
COVID-19 Emergency.exe
Resource
win10-en-20210920
Malware Config
Targets
-
-
Target
COVID-19 Emergency.exe
-
Size
610KB
-
MD5
ea4216e97a3007309295e8a7b769208b
-
SHA1
bf86f6614965d6ebd5d2ea10d46780a86b225c44
-
SHA256
7a4b1e5015937985613975df6c4f2046b0398c6e32ea10b780da1cce61ef3d44
-
SHA512
3d13436cfd5ab6db58b017fb7ffa1bfc62cecf9c899a5d880233457f0ac9dd331c37eca300271cdf2ed0cfb6a7e437299861aee3c8635bc33812fbc8830804ff
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-