General
-
Target
file.exe
-
Size
800KB
-
Sample
230322-lyfyhsgb56
-
MD5
c35736429b30030acb60cb19c771649e
-
SHA1
e45a11358fa376cc0dcf103e431aa3ea805370f0
-
SHA256
433bae3045c110790a9ba2a11bbbc39f5fd10a36c0422bcd6e706b0eedbba66b
-
SHA512
7e664ca187045a9dc1fbf432ad13f322fa33db7de15481c7bef9b6fe1ae59804ce396c5e1d40d15f8eb4c921bec3cab12336491882656927fa38897afd002b16
-
SSDEEP
6144:BZbvpVUeRkrE4sZ5vnZI1ET94aVgrpkghZuOOIZ34lQP9MWT:HTUeR/3Pnikled3ZupIV4m
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
file.exe
-
Size
800KB
-
MD5
c35736429b30030acb60cb19c771649e
-
SHA1
e45a11358fa376cc0dcf103e431aa3ea805370f0
-
SHA256
433bae3045c110790a9ba2a11bbbc39f5fd10a36c0422bcd6e706b0eedbba66b
-
SHA512
7e664ca187045a9dc1fbf432ad13f322fa33db7de15481c7bef9b6fe1ae59804ce396c5e1d40d15f8eb4c921bec3cab12336491882656927fa38897afd002b16
-
SSDEEP
6144:BZbvpVUeRkrE4sZ5vnZI1ET94aVgrpkghZuOOIZ34lQP9MWT:HTUeR/3Pnikled3ZupIV4m
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-