General
-
Target
Doc2050023RFT.exe
-
Size
1.5MB
-
Sample
221003-lkw3ksfhg5
-
MD5
c8dfc09ebcbda6de3cb18d2c5ca52483
-
SHA1
91f2bf86bb3d8d73fd9b09881087099b81315a8b
-
SHA256
9f3b0574ee8ea34114c6de2ed4f351552400569e42d4032a2ec5dcff3107af1c
-
SHA512
0b025d8c5f445d20a66b4d6195112addc9b5dc19b2c4897d50640e01af58ec2fb3f363a45273f2316a5fb09a44caf785f20b1e9df809b45259929475b156bd32
-
SSDEEP
12288:cnjoh8rQqH/jnWZQzjFeM6DJOjB9sTTHy3hPA4iDJQbLiQXxaURDEVmHCj3hPG7g:qLHbnYQb6VOL25DKnikzU36oGc
Static task
static1
Behavioral task
behavioral1
Sample
Doc2050023RFT.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Doc2050023RFT.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
agenttesla
http://45.155.165.63/3ip/inc/523ecb38582a9c.php
Targets
-
-
Target
Doc2050023RFT.exe
-
Size
1.5MB
-
MD5
c8dfc09ebcbda6de3cb18d2c5ca52483
-
SHA1
91f2bf86bb3d8d73fd9b09881087099b81315a8b
-
SHA256
9f3b0574ee8ea34114c6de2ed4f351552400569e42d4032a2ec5dcff3107af1c
-
SHA512
0b025d8c5f445d20a66b4d6195112addc9b5dc19b2c4897d50640e01af58ec2fb3f363a45273f2316a5fb09a44caf785f20b1e9df809b45259929475b156bd32
-
SSDEEP
12288:cnjoh8rQqH/jnWZQzjFeM6DJOjB9sTTHy3hPA4iDJQbLiQXxaURDEVmHCj3hPG7g:qLHbnYQb6VOL25DKnikzU36oGc
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-