General
-
Target
RFx - NRSB-SPCI_QHK_NRSB_SPCI_115R1_023.exe
-
Size
285KB
-
Sample
230703-bwx4xaec63
-
MD5
13a12db020fd20632377e76513b3ad46
-
SHA1
898e98541966df2ee2cdf79bfc04082c201a3a1f
-
SHA256
8ebc8abe7965da06078b418ac65d4b77c0dc069be320025034c583041d971df2
-
SHA512
b40a439d639027230130bd880bccb479572ed2cb9ebd99c28e5a4ec1403dee7fec10f8374146e77f170c0154ed61adb544ce63756de933dbe990c9f13128a7a0
-
SSDEEP
6144:/Ya6vLFNNU3IskPtsRC1yY5MlposxnHyVNdhQj+E3D7R0:/YFLFNN9T2C1Ra9nX+EXR0
Static task
static1
Behavioral task
behavioral1
Sample
RFx - NRSB-SPCI_QHK_NRSB_SPCI_115R1_023.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
RFx - NRSB-SPCI_QHK_NRSB_SPCI_115R1_023.exe
Resource
win10v2004-20230621-en
Malware Config
Targets
-
-
Target
RFx - NRSB-SPCI_QHK_NRSB_SPCI_115R1_023.exe
-
Size
285KB
-
MD5
13a12db020fd20632377e76513b3ad46
-
SHA1
898e98541966df2ee2cdf79bfc04082c201a3a1f
-
SHA256
8ebc8abe7965da06078b418ac65d4b77c0dc069be320025034c583041d971df2
-
SHA512
b40a439d639027230130bd880bccb479572ed2cb9ebd99c28e5a4ec1403dee7fec10f8374146e77f170c0154ed61adb544ce63756de933dbe990c9f13128a7a0
-
SSDEEP
6144:/Ya6vLFNNU3IskPtsRC1yY5MlposxnHyVNdhQj+E3D7R0:/YFLFNN9T2C1Ra9nX+EXR0
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-