General
-
Target
2fe7660d58b881541c1f929382f478d19f17fdb56f2e8b313b8cfc0545a615bd
-
Size
136KB
-
Sample
220521-xfy7xsbfd2
-
MD5
198cd80e37da0dbbaf969749e7ea1f9c
-
SHA1
d6e5dcad5b0ceae5db56d62750554d69e9c569b2
-
SHA256
2fe7660d58b881541c1f929382f478d19f17fdb56f2e8b313b8cfc0545a615bd
-
SHA512
f5d509e4ee75878f079109e4b8a056f850b67587b92e6d088e66bd79c05fdedaafb379b00d6e950bd7ab9f129351ec7be0aa911c5722254b2ea6e7eb3fc02b9d
Static task
static1
Behavioral task
behavioral1
Sample
2fe7660d58b881541c1f929382f478d19f17fdb56f2e8b313b8cfc0545a615bd.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2fe7660d58b881541c1f929382f478d19f17fdb56f2e8b313b8cfc0545a615bd.exe
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
2fe7660d58b881541c1f929382f478d19f17fdb56f2e8b313b8cfc0545a615bd
-
Size
136KB
-
MD5
198cd80e37da0dbbaf969749e7ea1f9c
-
SHA1
d6e5dcad5b0ceae5db56d62750554d69e9c569b2
-
SHA256
2fe7660d58b881541c1f929382f478d19f17fdb56f2e8b313b8cfc0545a615bd
-
SHA512
f5d509e4ee75878f079109e4b8a056f850b67587b92e6d088e66bd79c05fdedaafb379b00d6e950bd7ab9f129351ec7be0aa911c5722254b2ea6e7eb3fc02b9d
Score10/10-
suricata: ET MALWARE AgentTesla PWS HTTP CnC Checkin
suricata: ET MALWARE AgentTesla PWS HTTP CnC Checkin
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-