General
- Target 2702027a48bbc7e50d0c375d35ff0f32.exe
- Size 708KB
- Sample220121-ry56ashge8
- SHA256 fb6202135abab1d7fcd7f8deee6624ff76e49cfc8b33a27909a032c891f47ef7
- MD5 2702027a48bbc7e50d0c375d35ff0f32
- SHA1 7c2d402974758f3cb1f95d7ecb9ac0d4f785c3ab
- SHA512 0693d19738d9095040c3c4be28f662a1a673f03dce78ccb9b86d49c4c76528dc0bf9b6bec9f6d660c425269a1ef656719fa5bbff9ef36192e517fefafbb868b5
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
2702027a48bbc7e50d0c375d35ff0f32.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2702027a48bbc7e50d0c375d35ff0f32.exe
Resource
win10-en-20211208
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
C2
-
https://api.telegram.org/bot5001070930:AAGS6zcnpfl-Q3wAAaVHDGdca4bVokv7sYg/sendDocument
Targets
-
- Target 2702027a48bbc7e50d0c375d35ff0f32.exe
- Size 708KB
- SHA256 fb6202135abab1d7fcd7f8deee6624ff76e49cfc8b33a27909a032c891f47ef7
- MD5 2702027a48bbc7e50d0c375d35ff0f32
- SHA1 7c2d402974758f3cb1f95d7ecb9ac0d4f785c3ab
- SHA512 0693d19738d9095040c3c4be28f662a1a673f03dce78ccb9b86d49c4c76528dc0bf9b6bec9f6d660c425269a1ef656719fa5bbff9ef36192e517fefafbb868b5
- MD5 SHA1 SHA512
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext