General
-
Target
063f28e3797edbae945abd6e657b5d8955affce68efa069b8ca81c41cb0e23f0
-
Size
449KB
-
Sample
231204-nh4ezsag2x
-
MD5
1239e8d1ea6619dbe96906e4d1b8b3fc
-
SHA1
dd81aad9efa3d43686de02cf7234d7e16ce57283
-
SHA256
063f28e3797edbae945abd6e657b5d8955affce68efa069b8ca81c41cb0e23f0
-
SHA512
3c893883fa149c9bb93a551e94a321ea03b63b6e6ae7eb392bc54d14701eee6a47a3e11481bf0fc782e53d5721ae96eede0406e9b54180f6509e301b79bbedf0
-
SSDEEP
12288:xsPNV3zQLse/aeyuzBTfOlFPE3XDzOo76Zts9yb:G1VjnVnifOP832dsQb
Static task
static1
Behavioral task
behavioral1
Sample
Account Statement 4th December 2023.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
Account Statement 4th December 2023.exe
Resource
win10v2004-20231127-en
Malware Config
Targets
-
-
Target
Account Statement 4th December 2023.exe
-
Size
477KB
-
MD5
38e85567ecbe691d6319179e8e42fab2
-
SHA1
72f8f419447da72e61518a7ecdf433a4b05aa458
-
SHA256
188b48895639573a36270e0693569d98f7a673c975478927559c3eadd6d83839
-
SHA512
78c77591b9e381d9b3bf962693ec00f0ae94cadee813837095d4fb1e16282a93791d03a4323a52e57870632d7e09227cba1baaeee164264fb174e64a5d7c5d75
-
SSDEEP
12288:xkNqHWr7yJzMij4kfciX/wtf7FPEvPDvmtj9yx:xUq+IIefziB8vKjQx
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-