General
-
Target
17ac3e76b5c9719d443b2d2923fe44740ad57dbed4ca0b837996b98915a87100
-
Size
569KB
-
Sample
220521-nfvp3aggel
-
MD5
274b7648377cf491c81d4789d201ecee
-
SHA1
c6818c64916180adc27c92a671f82afdc6deecd7
-
SHA256
17ac3e76b5c9719d443b2d2923fe44740ad57dbed4ca0b837996b98915a87100
-
SHA512
31e72d232763b0e82c3ea3f3c5f1bd3b7d17779d7eba3f3349f80132a25fcb8138c9fa184577d4c818c74664b29b20b26bb43e1e0a1e84311a76fa7c444c0d5d
Static task
static1
Behavioral task
behavioral1
Sample
17ac3e76b5c9719d443b2d2923fe44740ad57dbed4ca0b837996b98915a87100.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
17ac3e76b5c9719d443b2d2923fe44740ad57dbed4ca0b837996b98915a87100.exe
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
17ac3e76b5c9719d443b2d2923fe44740ad57dbed4ca0b837996b98915a87100
-
Size
569KB
-
MD5
274b7648377cf491c81d4789d201ecee
-
SHA1
c6818c64916180adc27c92a671f82afdc6deecd7
-
SHA256
17ac3e76b5c9719d443b2d2923fe44740ad57dbed4ca0b837996b98915a87100
-
SHA512
31e72d232763b0e82c3ea3f3c5f1bd3b7d17779d7eba3f3349f80132a25fcb8138c9fa184577d4c818c74664b29b20b26bb43e1e0a1e84311a76fa7c444c0d5d
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Disables Task Manager via registry modification
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-