General
-
Target
4eb91f406ddb8ad22bc591a89d81e81b69824f0c9ff6067ef74f2d951d41e9ce
-
Size
872KB
-
Sample
211112-l952sadbb7
-
MD5
a5df1374654cd4d8974d032d63bb3a0c
-
SHA1
418396cbe3df6c452cfb0d0d8fd26138cb69ca5c
-
SHA256
4eb91f406ddb8ad22bc591a89d81e81b69824f0c9ff6067ef74f2d951d41e9ce
-
SHA512
0e3c43c58d84240563e4253371def590a94473b68efa0cd5812e7b6d7e97dd4aec74d3f343e70a7db8f918df6080232901f391d33f55d96666b42ae94b46605d
Static task
static1
Behavioral task
behavioral1
Sample
4eb91f406ddb8ad22bc591a89d81e81b69824f0c9ff6067ef74f2d951d41e9ce.exe
Resource
win10-en-20211104
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1923270472:AAFHljVp-f8Q5-X0iy70Vfe0aTch5THPa-U/sendDocument
Targets
-
-
Target
4eb91f406ddb8ad22bc591a89d81e81b69824f0c9ff6067ef74f2d951d41e9ce
-
Size
872KB
-
MD5
a5df1374654cd4d8974d032d63bb3a0c
-
SHA1
418396cbe3df6c452cfb0d0d8fd26138cb69ca5c
-
SHA256
4eb91f406ddb8ad22bc591a89d81e81b69824f0c9ff6067ef74f2d951d41e9ce
-
SHA512
0e3c43c58d84240563e4253371def590a94473b68efa0cd5812e7b6d7e97dd4aec74d3f343e70a7db8f918df6080232901f391d33f55d96666b42ae94b46605d
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Executes dropped EXE
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-