General
-
Target
d6a628fe234851cb3045421c715d20564d6838deeaa36385289e670e85f26daf
-
Size
386KB
-
Sample
220521-ndz7rsgfdr
-
MD5
24d0e492ec508f017e50ca44c50fd437
-
SHA1
35a0320aea5895e905961e1449eac1d76f2ef885
-
SHA256
d6a628fe234851cb3045421c715d20564d6838deeaa36385289e670e85f26daf
-
SHA512
fcaf2f571955e83487711ba957e79b2e6ffd7346a68935e7924a97605b93cb075a19c802cd38afa4e86648d0db66d220ec48cf20708501c0e859e56240cc42e3
Static task
static1
Behavioral task
behavioral1
Sample
News-Update.scr
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
News-Update.scr
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
News-Update.scr
-
Size
566KB
-
MD5
8db27a63baec87e325fe3245f6778790
-
SHA1
c639dd9daf6f010142a37ef1fac0fbd8a00c3efd
-
SHA256
8c254637c5c98fe6755a44e5ea6feba18d0a17c4ad53e8d791277390060c29e5
-
SHA512
423c2b2d5400079f21025c5c2f0242aba1aeaa3fd9844b06678246e20fc65ae027dbad161ddbb2be10ca61fa992903b21e0d29cd3c415145b760e047377c1201
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-