General
- Target DOCUMENT.exe
- Size 251KB
- Sample221007-rseq6achdn
- SHA256 9a289cec6288093e7065db5d81133d883205ef554d0f8744f7b3d3307bb0c228
- MD5 3d5665018e35ac31211f08362ba8191c
- SHA1 4b2c6a0c11b3b4cffc8fe3ffd9e581b37eb611d4
- SHA512 b91395814c727928db789e11e4ef038968dbb211b9c7d427c56a41ca8df47a810554276a4911c2d98a51d269e4d441c0166f4d1be5ee9a2ea875ff8e168aaad3
- SSDEEP 6144:BEPvM0OAxagD8NLYJRhqhL7C/Ze0dltczhOBdkE7j:UvMbAx98VYSCZDcoX7j
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
DOCUMENT.exe
Resource
win7-20220812-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
DOCUMENT.exe
Resource
win10v2004-20220812-en
8 signatures
150 seconds
Malware Config
Extracted
Credentials
-
Protocol
smtp
-
Host
mail.dinrack.com
-
Port
587
-
Username
-
Password
Dms12345*
Targets
-
- Target DOCUMENT.exe
- Size 251KB
- SHA256 9a289cec6288093e7065db5d81133d883205ef554d0f8744f7b3d3307bb0c228
- MD5 3d5665018e35ac31211f08362ba8191c
- SHA1 4b2c6a0c11b3b4cffc8fe3ffd9e581b37eb611d4
- SHA512 b91395814c727928db789e11e4ef038968dbb211b9c7d427c56a41ca8df47a810554276a4911c2d98a51d269e4d441c0166f4d1be5ee9a2ea875ff8e168aaad3
- SSDEEP 6144:BEPvM0OAxagD8NLYJRhqhL7C/Ze0dltczhOBdkE7j:UvMbAx98VYSCZDcoX7j
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext