General
-
Target
docfre20230925.exe
-
Size
1.1MB
-
Sample
230926-q7mjwabb27
-
MD5
a00366a3483d1d632223d68c8e6e3f15
-
SHA1
9d3e8a5526c15408d28ad1af21937020accc5ff2
-
SHA256
14bf7140553ce01a73ddd0bad30d173a14aa1614ee208b01f7a165969aefdc00
-
SHA512
8a2579d06efaa4f49e73b50993ddd15728639c3ec73a743939cfcb1e2b46c899386719a0c83aca55891b54d7e639e9099254bc35a4ba1f21f6346934c93a5a24
-
SSDEEP
24576:6oJkNU2vAuIan9AuMyLSisyKuMYc8u5XMxoZgnb3iPwwxA5MY:6ouFAuB9AuMyLSglMYdCMxoiboU
Static task
static1
Behavioral task
behavioral1
Sample
docfre20230925.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
docfre20230925.exe
Resource
win10v2004-20230915-en
Malware Config
Targets
-
-
Target
docfre20230925.exe
-
Size
1.1MB
-
MD5
a00366a3483d1d632223d68c8e6e3f15
-
SHA1
9d3e8a5526c15408d28ad1af21937020accc5ff2
-
SHA256
14bf7140553ce01a73ddd0bad30d173a14aa1614ee208b01f7a165969aefdc00
-
SHA512
8a2579d06efaa4f49e73b50993ddd15728639c3ec73a743939cfcb1e2b46c899386719a0c83aca55891b54d7e639e9099254bc35a4ba1f21f6346934c93a5a24
-
SSDEEP
24576:6oJkNU2vAuIan9AuMyLSisyKuMYc8u5XMxoZgnb3iPwwxA5MY:6ouFAuB9AuMyLSglMYdCMxoiboU
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Snake Keylogger payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-