General
-
Target
fa6b635dbeb54520183858face68bfb2056b9d6ca7f0f971b352f1ad90d80a48
-
Size
537KB
-
Sample
220625-lvnh7ahfd4
-
MD5
03e287ec10c07c45c359c024d423debc
-
SHA1
3c13bb9709fa850d6eb76a150f19840043935a39
-
SHA256
fa6b635dbeb54520183858face68bfb2056b9d6ca7f0f971b352f1ad90d80a48
-
SHA512
e57c3ce93756460287465fc05b61af4cf5b6d820f344ed15b01dba0322a63bfaee6b72125367332d95cec77bb570d9b18ca4d70b5146e8db492b4a29d7416a5f
Static task
static1
Behavioral task
behavioral1
Sample
fa6b635dbeb54520183858face68bfb2056b9d6ca7f0f971b352f1ad90d80a48.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
fa6b635dbeb54520183858face68bfb2056b9d6ca7f0f971b352f1ad90d80a48.exe
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
fa6b635dbeb54520183858face68bfb2056b9d6ca7f0f971b352f1ad90d80a48
-
Size
537KB
-
MD5
03e287ec10c07c45c359c024d423debc
-
SHA1
3c13bb9709fa850d6eb76a150f19840043935a39
-
SHA256
fa6b635dbeb54520183858face68bfb2056b9d6ca7f0f971b352f1ad90d80a48
-
SHA512
e57c3ce93756460287465fc05b61af4cf5b6d820f344ed15b01dba0322a63bfaee6b72125367332d95cec77bb570d9b18ca4d70b5146e8db492b4a29d7416a5f
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-