General
- Target DOCUMENTS.zip
- Size 252KB
- Sample230704-g5224sbc85
- SHA256 53136e799f0a836c61355ff21e9a950d3ee76e54efa7178e73e6bf6bdc18f507
- MD5 bffadcebf6ce5296075595a2bd1af2a6
- SHA1 85c5265d70e274906be7fe611e0b0737c4aa1d0b
- SHA512 c40881c18c4089e4ba791134e5e7da23185935214ae37812ab7de81cd614caaecb2fddcf98f59cd427d3b1486ecd114460f3807cca2d6bb8cf9fe66fbf8352f8
- SSDEEP 6144:OYonmIw6l4+x/yEHL6J1D8xTYUFnRx98TJmsdFu3s99vTtmSA:5ovl4+xaIM1D8xTHoTJmUuc0SA
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DOCUMENTS.exe
Resource
win7-20230703-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
DOCUMENTS.exe
Resource
win10v2004-20230703-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target DOCUMENTS.exe
- Size 266KB
- SHA256 0667f28a0d30bacde293358f9fe655f0650fed4efd2ffbdf25123ae10350b50e
- MD5 cbcf7349a287adfbdb49c5bfbdd370ca
- SHA1 3fb0aacfaddf5b88c9ec9b8714ea32e7e4661977
- SHA512 15050493942dac65a7ec554deadbb2fa06a78f1a9d6ff8d0ff74d6ceacbb8c8d473bb0aa39b7136afef942a33c6303adae5868399546b4fd092754dc4af81265
- SSDEEP 6144:/Ya6gY4l4+x/yE/L6J1D8xTYUFnRr9ATJmsdFu3s99vWtmS/:/Y2Y4l4+xaOM1D8xTHaTJmUucHS/
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext