General
-
Target
Certificate.Pdf.z
-
Size
289KB
-
Sample
230613-lse42aff67
-
MD5
43c9cc8180d63c88d536341a0e7ac005
-
SHA1
bd18611819119b7648c6d5f985519324b3904fab
-
SHA256
89585c44076c1387bf8da92c5d514c39fa02ddd3accb6f548d1b92acfe78ff20
-
SHA512
cf74e70038977eae1d65ab001f6c9ec70175f336bcd8aa3d5b5effaeaad3bef703a11cd87240633d8e01296450f8933ae13fa02521f02a5257ac78205b6fd1c1
-
SSDEEP
6144:CNLOLsv0KhjNRgpZqMuHLabZprN4SIBZByD3vcD9QtdyIbbg:uLx0KhjXuZuanyT+DknYg
Static task
static1
Behavioral task
behavioral1
Sample
Certificate.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Certificate.exe
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
Certificate.exe
-
Size
331KB
-
MD5
91697062207628ac69072dfa42c0b59d
-
SHA1
3900d82634526d2701f6febe4975f8ac84b56a4b
-
SHA256
6631aace38dd7550a1a18350a43606bc2eb26380cc99fd6acafdf75f226498bb
-
SHA512
4bb68522386ca17a580f2667fcfcdf823d0a3b44ad069034208c77966d4dccfc84c30735a3940649eb5a9e1a91894f1aad1b26943f7cf4cf20e45036de1785c9
-
SSDEEP
6144:wYa6R3QL/klDalb8eNatTpTemlJtu1lXLS7wAW6MhEt1LC:wYH3No8/TpT5xuu3W6zt1LC
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-