General
-
Target
6b2bb54994181abc60e682522278e12395c5ca18874548fa7f7bd914da065330
-
Size
634KB
-
Sample
220521-ntw52sebc7
-
MD5
7d68209ad201cd9d2919016e4ee723d1
-
SHA1
8dbfae1cdb44bfae0431fa816d7cacab292706c2
-
SHA256
6b2bb54994181abc60e682522278e12395c5ca18874548fa7f7bd914da065330
-
SHA512
0f58ca71e1a5be697c31da711f1a249c57fcd3699feb064d5d7150ccd6163ee0177db5078b35f00fc17aabeb44f21da9735921aac6ad05e4c4888f3e93a6d5c3
Static task
static1
Behavioral task
behavioral1
Sample
6b2bb54994181abc60e682522278e12395c5ca18874548fa7f7bd914da065330.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
6b2bb54994181abc60e682522278e12395c5ca18874548fa7f7bd914da065330.exe
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
6b2bb54994181abc60e682522278e12395c5ca18874548fa7f7bd914da065330
-
Size
634KB
-
MD5
7d68209ad201cd9d2919016e4ee723d1
-
SHA1
8dbfae1cdb44bfae0431fa816d7cacab292706c2
-
SHA256
6b2bb54994181abc60e682522278e12395c5ca18874548fa7f7bd914da065330
-
SHA512
0f58ca71e1a5be697c31da711f1a249c57fcd3699feb064d5d7150ccd6163ee0177db5078b35f00fc17aabeb44f21da9735921aac6ad05e4c4888f3e93a6d5c3
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-