General
-
Target
fc23a4a16e5f2ad4467d969f7a53b5a67d9d3d33ef3d4.exe
-
Size
1.4MB
-
Sample
221003-lkw3kshdcm
-
MD5
10dcb9e5aabe78f2bf22481b70658d15
-
SHA1
19dad72451cb471f9762a6a7c72e57f2f17197bf
-
SHA256
fc23a4a16e5f2ad4467d969f7a53b5a67d9d3d33ef3d427c7aa883916f8c251c
-
SHA512
1afc876a8b5626a38af604a30127b0a1af9d0aa358b7fdb0e544e0f408a6599a7df5283fe09896eee04bd859b1dc0aff83481911a2e4a37bc02f1465f8f3f6dc
-
SSDEEP
12288:pnjoI3rQqH/jnWZQzjFeM6DJOjB9sTTHyodgEGqURVOpsc534IToHIRiBOaIOvkz:hLHbnYQb6VO9RSscqNc
Static task
static1
Behavioral task
behavioral1
Sample
fc23a4a16e5f2ad4467d969f7a53b5a67d9d3d33ef3d4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fc23a4a16e5f2ad4467d969f7a53b5a67d9d3d33ef3d4.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
agenttesla
http://45.155.165.63/3ip/inc/523ecb38582a9c.php
Targets
-
-
Target
fc23a4a16e5f2ad4467d969f7a53b5a67d9d3d33ef3d4.exe
-
Size
1.4MB
-
MD5
10dcb9e5aabe78f2bf22481b70658d15
-
SHA1
19dad72451cb471f9762a6a7c72e57f2f17197bf
-
SHA256
fc23a4a16e5f2ad4467d969f7a53b5a67d9d3d33ef3d427c7aa883916f8c251c
-
SHA512
1afc876a8b5626a38af604a30127b0a1af9d0aa358b7fdb0e544e0f408a6599a7df5283fe09896eee04bd859b1dc0aff83481911a2e4a37bc02f1465f8f3f6dc
-
SSDEEP
12288:pnjoI3rQqH/jnWZQzjFeM6DJOjB9sTTHyodgEGqURVOpsc534IToHIRiBOaIOvkz:hLHbnYQb6VO9RSscqNc
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-