General
- Target temyiz taslağı yedek.docx.exe
- Size 297KB
- Sample230522-kqe6ksfb63
- SHA256 62dc73beb92c72827a3408e42c9220f5d33258258ff03bfc7285d02f7372eee8
- MD5 404453c503071a38e62c6c7f33aad2c4
- SHA1 6e046e750d746e7f78534c447067c6d2c29e0c4c
- SHA512 3fb3cad340d3633b73fce5c0cba7c2f6b338dea8fbca2c849ba95355347f8f8bd21fe472bf0413515f447a715db83b14c85ed58711abf1ac0d4b711ee6ea33a1
- SSDEEP 6144:vYa64E69ubSN7IL3DQ2/TAM02FjGOhCIqXG6EY8gnCNUkhJCoA:vYWE69QSNh2/TA7QyyCP2vfNQ
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
temyiz taslağı yedek.docx.exe
Resource
win7-20230220-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
temyiz taslağı yedek.docx.exe
Resource
win10v2004-20230220-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target temyiz taslağı yedek.docx.exe
- Size 297KB
- SHA256 62dc73beb92c72827a3408e42c9220f5d33258258ff03bfc7285d02f7372eee8
- MD5 404453c503071a38e62c6c7f33aad2c4
- SHA1 6e046e750d746e7f78534c447067c6d2c29e0c4c
- SHA512 3fb3cad340d3633b73fce5c0cba7c2f6b338dea8fbca2c849ba95355347f8f8bd21fe472bf0413515f447a715db83b14c85ed58711abf1ac0d4b711ee6ea33a1
- SSDEEP 6144:vYa64E69ubSN7IL3DQ2/TAM02FjGOhCIqXG6EY8gnCNUkhJCoA:vYWE69QSNh2/TA7QyyCP2vfNQ
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext