General
- Target rDocumentosdeembarqueCI.exe
- Size 1.1MB
- Sample231221-vb858adfe2
- SHA256 2c112aa6303f06bac17ef65b8e3aa5cfd582e2aaf04e0036c39216d8965ad804
- MD5 2b8d52006fc4f5c0dd8dac75f2d315ae
- SHA1 2068d5fc7c011f5356c0e419a8d4e1836ac635d1
- SHA512 0d4964dc4e79c737422ec0301a1dd75e326dd2b4c7fa55c861eb9914c8d9c0beb5795353d631626cca9bb7b88881de2fa3ea90bb4b4784ef39eaebecc95c470d
- SSDEEP 24576:ek70TrcN/imA7oFkT2F5RvrFyBWTipXFT:ekQTANahcG23RjUBRpXFT
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
rDocumentosdeembarqueCI.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
rDocumentosdeembarqueCI.exe
Resource
win10v2004-20231215-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
C2
-
https://discord.com/api/webhooks/1186834019627827270/y0S-n-hBE1jR15tIr1j1sESR1UsUyFoPzm0ZqLatEGGEP8xXdU9hk3RwMYMEZqV8QFo2
Targets
-
- Target rDocumentosdeembarqueCI.exe
- Size 1.1MB
- SHA256 2c112aa6303f06bac17ef65b8e3aa5cfd582e2aaf04e0036c39216d8965ad804
- MD5 2b8d52006fc4f5c0dd8dac75f2d315ae
- SHA1 2068d5fc7c011f5356c0e419a8d4e1836ac635d1
- SHA512 0d4964dc4e79c737422ec0301a1dd75e326dd2b4c7fa55c861eb9914c8d9c0beb5795353d631626cca9bb7b88881de2fa3ea90bb4b4784ef39eaebecc95c470d
- SSDEEP 24576:ek70TrcN/imA7oFkT2F5RvrFyBWTipXFT:ekQTANahcG23RjUBRpXFT
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext