General
-
Target
98f2f77a976c289adaf4fd693ff8b888027461d46184e117388f316209692ff7
-
Size
734KB
-
Sample
211112-qpfnlsaegl
-
MD5
f2a5e9b90a3c266f888fe2d839048950
-
SHA1
2e1e2c50b27fef578dc6e7634b01f8edf7aea909
-
SHA256
98f2f77a976c289adaf4fd693ff8b888027461d46184e117388f316209692ff7
-
SHA512
fb4b199609ed75cf362e6d094b4703c2732746fa98a88a1bf8c9183ad81053c568cfb4e5da98785df5c275adc41e3fbbe562751fba5572703d7b18fd5e2148e0
Static task
static1
Behavioral task
behavioral1
Sample
98f2f77a976c289adaf4fd693ff8b888027461d46184e117388f316209692ff7.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1923270472:AAFHljVp-f8Q5-X0iy70Vfe0aTch5THPa-U/sendDocument
Targets
-
-
Target
98f2f77a976c289adaf4fd693ff8b888027461d46184e117388f316209692ff7
-
Size
734KB
-
MD5
f2a5e9b90a3c266f888fe2d839048950
-
SHA1
2e1e2c50b27fef578dc6e7634b01f8edf7aea909
-
SHA256
98f2f77a976c289adaf4fd693ff8b888027461d46184e117388f316209692ff7
-
SHA512
fb4b199609ed75cf362e6d094b4703c2732746fa98a88a1bf8c9183ad81053c568cfb4e5da98785df5c275adc41e3fbbe562751fba5572703d7b18fd5e2148e0
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Executes dropped EXE
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-