General
-
Target
228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa
-
Size
408KB
-
Sample
231206-djgbqsae82
-
MD5
750362927420a2b4b15b9b3bf0b48d80
-
SHA1
92ed4dff52d92c931bfc68f9c1da260bc6836c92
-
SHA256
228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa
-
SHA512
27bb863bfc1c4e78bde41035365af698e91f3bb365c45727de397d777ff369cf60427b9f9ca78ed5b0f3a36c194114f252a52e4ca1d5cde6004b39e6ce6493fa
-
SSDEEP
6144:P8LxB0ipoXRl6686UvtuY89JWdPo92oo9hejx7qT4UJuROph4Hc2eCm1/rFb:xTBl668jvEJ2Po92hWIB5pZV1/rp
Static task
static1
Behavioral task
behavioral1
Sample
228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa.exe
Resource
win10v2004-20231130-en
Malware Config
Targets
-
-
Target
228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa
-
Size
408KB
-
MD5
750362927420a2b4b15b9b3bf0b48d80
-
SHA1
92ed4dff52d92c931bfc68f9c1da260bc6836c92
-
SHA256
228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa
-
SHA512
27bb863bfc1c4e78bde41035365af698e91f3bb365c45727de397d777ff369cf60427b9f9ca78ed5b0f3a36c194114f252a52e4ca1d5cde6004b39e6ce6493fa
-
SSDEEP
6144:P8LxB0ipoXRl6686UvtuY89JWdPo92oo9hejx7qT4UJuROph4Hc2eCm1/rFb:xTBl668jvEJ2Po92hWIB5pZV1/rp
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-