General
-
Target
docnic20230925.exe
-
Size
1.1MB
-
Sample
230926-q6dwcahg3s
-
MD5
010ef94907f5876e46be0ed87689fde9
-
SHA1
7c142550561efe5f513d269f134a6d15ce28d24c
-
SHA256
8d9a8f9de34a75aeba8164f658881f4c142690b58c8cf30486f18574a8e14185
-
SHA512
d14f04995edf513e0540e2cbf7657da25e5bd4d1ad602d72ccf13d84dc938c2950e6aae96329fc50ce14cb7120d79ab05539c0d917ae3a82bb97f509e65b6ae9
-
SSDEEP
24576:lurGpIFO+xYcXvbNqzuxHozoi0a9SwY1S4o0DoNy0p:lu0IPfbNq6xmoi8w+S4B0p
Static task
static1
Behavioral task
behavioral1
Sample
docnic20230925.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
docnic20230925.exe
Resource
win10v2004-20230915-en
Malware Config
Targets
-
-
Target
docnic20230925.exe
-
Size
1.1MB
-
MD5
010ef94907f5876e46be0ed87689fde9
-
SHA1
7c142550561efe5f513d269f134a6d15ce28d24c
-
SHA256
8d9a8f9de34a75aeba8164f658881f4c142690b58c8cf30486f18574a8e14185
-
SHA512
d14f04995edf513e0540e2cbf7657da25e5bd4d1ad602d72ccf13d84dc938c2950e6aae96329fc50ce14cb7120d79ab05539c0d917ae3a82bb97f509e65b6ae9
-
SSDEEP
24576:lurGpIFO+xYcXvbNqzuxHozoi0a9SwY1S4o0DoNy0p:lu0IPfbNq6xmoi8w+S4B0p
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Snake Keylogger payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-