General
- Target TT Payment.exe
- Size 292KB
- Sample230714-qf3rsafa2s
- SHA256 ce33bd7da486a90b2654cfed2c52f1cdb23c2183ace17f4ae26eb36531c6e0ee
- MD5 d15878ac010ed1de01a1c90839246c01
- SHA1 a96a3dbdf7a90b64998196873085bee561dab6b6
- SHA512 185a87873b73f586b048869be48ccd0be182a1c118abccbe5293851e68611db442798df4f457613ae1ab420e503f0e7f278ab183ac7f0e850ddbaaaf7e7b8927
- SSDEEP 6144:PYa6mIsLZVsl4aSA8QDCXG0hCnGoIPz7WhOTQiJlva6Uvvr81UN:PYIImIl4681x5b7WhOEqa7Y1s
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
TT Payment.exe
Resource
win7-20230712-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
TT Payment.exe
Resource
win10v2004-20230703-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target TT Payment.exe
- Size 292KB
- SHA256 ce33bd7da486a90b2654cfed2c52f1cdb23c2183ace17f4ae26eb36531c6e0ee
- MD5 d15878ac010ed1de01a1c90839246c01
- SHA1 a96a3dbdf7a90b64998196873085bee561dab6b6
- SHA512 185a87873b73f586b048869be48ccd0be182a1c118abccbe5293851e68611db442798df4f457613ae1ab420e503f0e7f278ab183ac7f0e850ddbaaaf7e7b8927
- SSDEEP 6144:PYa6mIsLZVsl4aSA8QDCXG0hCnGoIPz7WhOTQiJlva6Uvvr81UN:PYIImIl4681x5b7WhOEqa7Y1s
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext