General
-
Target
861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1
-
Size
720KB
-
Sample
230206-res2mahe4w
-
MD5
042e7c28f1bdf5bd7eb6c050a18bde92
-
SHA1
bde9069ebcecd98751e66655aa11401c29731dbd
-
SHA256
861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1
-
SHA512
b1ed1fa6ad1c0461da28450b174dbdda2f7c3981533bc1dbd06128a8a79321a744447419e69cf236812b6f2d9f2f038e2aea7acd3b08cb6d85cf51e2ddaea701
-
SSDEEP
12288:MXmkpZX2jjeh+8DVWJBtESRr2DTSVKjAiSGVHWeh3ih9HXA:AZmeh9WJIi1ojAiBVHBYTQ
Static task
static1
Behavioral task
behavioral1
Sample
861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5056459562:AAHQW9wJvHEkQsnxuML0xV3IDA6-DUuUNFI/sendDocument
Targets
-
-
Target
861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1
-
Size
720KB
-
MD5
042e7c28f1bdf5bd7eb6c050a18bde92
-
SHA1
bde9069ebcecd98751e66655aa11401c29731dbd
-
SHA256
861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1
-
SHA512
b1ed1fa6ad1c0461da28450b174dbdda2f7c3981533bc1dbd06128a8a79321a744447419e69cf236812b6f2d9f2f038e2aea7acd3b08cb6d85cf51e2ddaea701
-
SSDEEP
12288:MXmkpZX2jjeh+8DVWJBtESRr2DTSVKjAiSGVHWeh3ih9HXA:AZmeh9WJIi1ojAiBVHBYTQ
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-