General
-
Target
e738c0ddfae27c1555afe0e80c062654c5b30edf3f6052f5298816f8d6419145
-
Size
841KB
-
Sample
221125-l8434add4x
-
MD5
cdee2503876d1fc68a0f882f1c6b98a0
-
SHA1
f98ac1b174c36f3e3244c32f4798c85e67e9fc5e
-
SHA256
e738c0ddfae27c1555afe0e80c062654c5b30edf3f6052f5298816f8d6419145
-
SHA512
a9bee9a42b67a881272ca3babb4845506d87ab3e20a89d7aa1afaf4f44b1f6fa94c947ee15ce41eb841a3e40975dc6d565a639ce7d288870f09dd3c7aa342b36
-
SSDEEP
24576:lr18bHTcXSrNxs8DgwgD+GEwV3X9EI6B2P:r8rIXSrv7Do6GtBtEI6Bm
Static task
static1
Behavioral task
behavioral1
Sample
e738c0ddfae27c1555afe0e80c062654c5b30edf3f6052f5298816f8d6419145.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e738c0ddfae27c1555afe0e80c062654c5b30edf3f6052f5298816f8d6419145.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1338829993:AAGkgJ80sLaIYwBfp79Ps5EtdSP1XH6jBV8/sendDocument
Targets
-
-
Target
e738c0ddfae27c1555afe0e80c062654c5b30edf3f6052f5298816f8d6419145
-
Size
841KB
-
MD5
cdee2503876d1fc68a0f882f1c6b98a0
-
SHA1
f98ac1b174c36f3e3244c32f4798c85e67e9fc5e
-
SHA256
e738c0ddfae27c1555afe0e80c062654c5b30edf3f6052f5298816f8d6419145
-
SHA512
a9bee9a42b67a881272ca3babb4845506d87ab3e20a89d7aa1afaf4f44b1f6fa94c947ee15ce41eb841a3e40975dc6d565a639ce7d288870f09dd3c7aa342b36
-
SSDEEP
24576:lr18bHTcXSrNxs8DgwgD+GEwV3X9EI6B2P:r8rIXSrv7Do6GtBtEI6Bm
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-