General
-
Target
37096691.exe
-
Size
1.2MB
-
Sample
221123-tehl1adg94
-
MD5
f534050fa4d9012dd54e13ce691d662e
-
SHA1
916a083d0045e365d889164e59c039d526c44684
-
SHA256
37096691833e6bd3112ec4ad96df261c532c32f50adef7797bb9489f9a3aea97
-
SHA512
bb7323176acd486fd526560522a65255819bd59ac44e17d3076fcb06be2891c7accbcc8e827445db72914ee041b5880308174ab5d8de46c5a7d591ab05841141
-
SSDEEP
24576:e+YAumA1be5ysgG12LltOOr3C1zC+GGOG4emawVl9Rg:D/eG273H+GS4XawVry
Static task
static1
Behavioral task
behavioral1
Sample
37096691.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
37096691.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
37096691.exe
-
Size
1.2MB
-
MD5
f534050fa4d9012dd54e13ce691d662e
-
SHA1
916a083d0045e365d889164e59c039d526c44684
-
SHA256
37096691833e6bd3112ec4ad96df261c532c32f50adef7797bb9489f9a3aea97
-
SHA512
bb7323176acd486fd526560522a65255819bd59ac44e17d3076fcb06be2891c7accbcc8e827445db72914ee041b5880308174ab5d8de46c5a7d591ab05841141
-
SSDEEP
24576:e+YAumA1be5ysgG12LltOOr3C1zC+GGOG4emawVl9Rg:D/eG273H+GS4XawVry
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-