General
-
Target
ddaf012089c54f6e8eaa8716514fd24359ece54166efb2e46d471a5c3bd68126
-
Size
872KB
-
Sample
220520-3pcm6shcd3
-
MD5
d4ce2c8151827421edcc28f7fa90b496
-
SHA1
99b6d403c4040dc4c40a69a7053cdff7871368b6
-
SHA256
ddaf012089c54f6e8eaa8716514fd24359ece54166efb2e46d471a5c3bd68126
-
SHA512
8b6ade5d1004d4f0b2f076b0724f7beba81f16f59ad397423b80d33085ab4d6b4ecfd107ed384d2b29ea2dd1ab909ca6159a2382a70f71c40be116d4addd6b1c
Static task
static1
Behavioral task
behavioral1
Sample
Scan_INV0719.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Scan_INV0719.exe
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
Scan_INV0719.exe
-
Size
795KB
-
MD5
97d445e3b07a19c03b0645affc4add14
-
SHA1
ebef5683355560d5463e66996cc2878f3670d678
-
SHA256
c4412b2563fa12f9cfb74a6c5f6cd63fa17afd15ef374cf846f3b808e9a01fb5
-
SHA512
3f0b772eb07a5d121ec2823811ce70e49f600571d07662aca2563d9f9821b588d5b37756008cdc920245a47f5e9acaba6fe750f6a886fce082fe3577912d0fd2
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-