General
- Target SecuriteInfo.com.W32.AIDetectNet.01.6187.7175
- Size 23KB
- Sample220714-mv4e3saeg8
- SHA256 4f5057f749812cda5d588b54fa0e514a3c0acf82d2a7bc6ec4eb7074cc950683
- MD5 b39ee6dec57d823eb38dd95f71de0236
- SHA1 8c14cc39a2363ff2bf62f2fb92e533110046b2f2
- SHA512 0955e9ee1a2f852fb06a4c5b3e7d0b8801c15a3341ee672d10eb99cf4b9d479ac5d74245beb79d4b10e6a7912a691c913bf5234d9bf520fc2fc648fc7dd97466
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetectNet.01.6187.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.W32.AIDetectNet.01.6187.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
C2
-
https://api.telegram.org/bot5254575276:AAFWaXU-iUq7XUY5iCKZ19_bcweDLz5oZhE/sendDocument
Targets
-
- Target SecuriteInfo.com.W32.AIDetectNet.01.6187.7175
- Size 23KB
- SHA256 4f5057f749812cda5d588b54fa0e514a3c0acf82d2a7bc6ec4eb7074cc950683
- MD5 b39ee6dec57d823eb38dd95f71de0236
- SHA1 8c14cc39a2363ff2bf62f2fb92e533110046b2f2
- SHA512 0955e9ee1a2f852fb06a4c5b3e7d0b8801c15a3341ee672d10eb99cf4b9d479ac5d74245beb79d4b10e6a7912a691c913bf5234d9bf520fc2fc648fc7dd97466
- MD5 SHA1 SHA512
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext