General
-
Target
d8ead95646470952403879a6bc78117d895ffe37a3b3a551cf65731a1260c8ad
-
Size
748KB
-
Sample
221206-wg8bjsae56
-
MD5
4e5cd63890a6f272b11c20333055c955
-
SHA1
bada19d00c5a614504cfb820507ac5d110a82963
-
SHA256
d8ead95646470952403879a6bc78117d895ffe37a3b3a551cf65731a1260c8ad
-
SHA512
e76c40582c98db680e5e96280e528e12c8bb3a6f096d2950576ca017ab05497217a1ea50ea28ffd049afa296baf503fc71d06a6d979af65c91d479895ea969ce
-
SSDEEP
12288:8wlk3UmomPZefh/B8dSIJo94T1QKaTnqhEXEhmLQGcg4Ptqvyuv/A:Apomxih/Ba/JocaTfXEhmchfQF3A
Static task
static1
Behavioral task
behavioral1
Sample
d8ead95646470952403879a6bc78117d895ffe37a3b3a551cf65731a1260c8ad.exe
Resource
win10-20220901-en
Malware Config
Targets
-
-
Target
d8ead95646470952403879a6bc78117d895ffe37a3b3a551cf65731a1260c8ad
-
Size
748KB
-
MD5
4e5cd63890a6f272b11c20333055c955
-
SHA1
bada19d00c5a614504cfb820507ac5d110a82963
-
SHA256
d8ead95646470952403879a6bc78117d895ffe37a3b3a551cf65731a1260c8ad
-
SHA512
e76c40582c98db680e5e96280e528e12c8bb3a6f096d2950576ca017ab05497217a1ea50ea28ffd049afa296baf503fc71d06a6d979af65c91d479895ea969ce
-
SSDEEP
12288:8wlk3UmomPZefh/B8dSIJo94T1QKaTnqhEXEhmLQGcg4Ptqvyuv/A:Apomxih/Ba/JocaTfXEhmchfQF3A
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-