General
-
Target
AvEQnWGwPb43iCj.exe
-
Size
1.3MB
-
Sample
220930-zpvxzaegg5
-
MD5
771559a28a51936053a811c912b26b39
-
SHA1
a6e9444dfbe540e332a07edae3db9bdca167b41b
-
SHA256
92b26f5c64684db2b440654c2efad6990005157394c0a2a3d60b556499e2bdcb
-
SHA512
d1c82cc08640865d7702a714bcceffa601a24915b9dd6517aaa2fb5a5c3dcb193f27ad6859e2a505f5c6071cf6d04cee9a4d079c46796c344bd5031670e3531b
-
SSDEEP
24576:tSPXe1vGMY3NMDKV1Wyk0xMCkmti2lIAhJ:tS25GcKV1T12lOil2
Static task
static1
Behavioral task
behavioral1
Sample
AvEQnWGwPb43iCj.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
AvEQnWGwPb43iCj.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
Protocol: smtp- Host:
smtp.chinarcnd.com - Port:
587 - Username:
[email protected] - Password:
HS*PSwS9
Targets
-
-
Target
AvEQnWGwPb43iCj.exe
-
Size
1.3MB
-
MD5
771559a28a51936053a811c912b26b39
-
SHA1
a6e9444dfbe540e332a07edae3db9bdca167b41b
-
SHA256
92b26f5c64684db2b440654c2efad6990005157394c0a2a3d60b556499e2bdcb
-
SHA512
d1c82cc08640865d7702a714bcceffa601a24915b9dd6517aaa2fb5a5c3dcb193f27ad6859e2a505f5c6071cf6d04cee9a4d079c46796c344bd5031670e3531b
-
SSDEEP
24576:tSPXe1vGMY3NMDKV1Wyk0xMCkmti2lIAhJ:tS25GcKV1T12lOil2
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-