General
-
Target
Account Statement_#216_03 April.exe
-
Size
497KB
-
Sample
230403-mfczksea92
-
MD5
6de6ecf40692dbd08e2ae442b942f868
-
SHA1
e0ad54c2844947b74bcbb6587efc27238f6eb584
-
SHA256
1c8980a32b195ccfe41474868abafb174d9f99b338b5f50ae4d071701f908266
-
SHA512
e6cf6cc70ddcafa2693c73481b10aa0545df4ad24a3fc912a6b9f50dfaeced95456f87dcab0c58d908c6a89f528ef2e38ae899e71428adc381b5c235a25e6438
-
SSDEEP
12288:zDQawURHJFy9aMArqkmqkmq9vU1Z4elq:z1wNAA
Static task
static1
Behavioral task
behavioral1
Sample
Account Statement_#216_03 April.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Account Statement_#216_03 April.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5285285345:AAGBQJ8X9DwvBlyjJ-biqMdKH9XM-DdPBF0/
Targets
-
-
Target
Account Statement_#216_03 April.exe
-
Size
497KB
-
MD5
6de6ecf40692dbd08e2ae442b942f868
-
SHA1
e0ad54c2844947b74bcbb6587efc27238f6eb584
-
SHA256
1c8980a32b195ccfe41474868abafb174d9f99b338b5f50ae4d071701f908266
-
SHA512
e6cf6cc70ddcafa2693c73481b10aa0545df4ad24a3fc912a6b9f50dfaeced95456f87dcab0c58d908c6a89f528ef2e38ae899e71428adc381b5c235a25e6438
-
SSDEEP
12288:zDQawURHJFy9aMArqkmqkmq9vU1Z4elq:z1wNAA
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-