General
-
Target
7c772b1c4ba1a6cb92a97314277ff62be83baccc05e385b044e226245faf5f36
-
Size
1.2MB
-
Sample
240327-bvqy7scb2s
-
MD5
825399a8feef99272b3b3d1ecf6a24dd
-
SHA1
e6b356e65c8d5925ce26831aa9a0e8394be2738b
-
SHA256
7c772b1c4ba1a6cb92a97314277ff62be83baccc05e385b044e226245faf5f36
-
SHA512
86ba270e4e64071a76a2419ffbc85ee342589d5b29f2ed1cb2a77fec0014c5d207a64e9b5abec2287c054ad505a8fe6fc98d5a15144c8ad781d8a52d7b3716da
-
SSDEEP
24576:cqDEvCTbMWu7rQYlBQcBiT6rprG8aol1RqnlZtVV9DalVfOI:cTvC/MTQYxsWR7aolzqHtYO
Static task
static1
Behavioral task
behavioral1
Sample
7c772b1c4ba1a6cb92a97314277ff62be83baccc05e385b044e226245faf5f36.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7c772b1c4ba1a6cb92a97314277ff62be83baccc05e385b044e226245faf5f36.exe
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
7c772b1c4ba1a6cb92a97314277ff62be83baccc05e385b044e226245faf5f36
-
Size
1.2MB
-
MD5
825399a8feef99272b3b3d1ecf6a24dd
-
SHA1
e6b356e65c8d5925ce26831aa9a0e8394be2738b
-
SHA256
7c772b1c4ba1a6cb92a97314277ff62be83baccc05e385b044e226245faf5f36
-
SHA512
86ba270e4e64071a76a2419ffbc85ee342589d5b29f2ed1cb2a77fec0014c5d207a64e9b5abec2287c054ad505a8fe6fc98d5a15144c8ad781d8a52d7b3716da
-
SSDEEP
24576:cqDEvCTbMWu7rQYlBQcBiT6rprG8aol1RqnlZtVV9DalVfOI:cTvC/MTQYxsWR7aolzqHtYO
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-