General
-
Target
c5d4f27e2805a98e80299d6a1c0c811ec883c5cbb3f52843a8ca680407e2fc59
-
Size
1.2MB
-
Sample
240727-bgl34azcqg
-
MD5
405e2e446d2385a3eb06cc61ca6a6e9e
-
SHA1
7f3e37b6f4083f936af217dd75307c0b3313f0fd
-
SHA256
c5d4f27e2805a98e80299d6a1c0c811ec883c5cbb3f52843a8ca680407e2fc59
-
SHA512
2f836b195cf09003df5054b4ae883f9cf7b38022dea6b2c72af9791c2cd0cfc28eb4b28eb69ce064b64b7bf3d8111312b97fa57613ffbf885363b93858adeee5
-
SSDEEP
24576:DqDEvCTbMWu7rQYlBQcBiT6rprG8al5LQoxdqBMR:DTvC/MTQYxsWR7aleWqBM
Static task
static1
Behavioral task
behavioral1
Sample
c5d4f27e2805a98e80299d6a1c0c811ec883c5cbb3f52843a8ca680407e2fc59.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c5d4f27e2805a98e80299d6a1c0c811ec883c5cbb3f52843a8ca680407e2fc59.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
c5d4f27e2805a98e80299d6a1c0c811ec883c5cbb3f52843a8ca680407e2fc59
-
Size
1.2MB
-
MD5
405e2e446d2385a3eb06cc61ca6a6e9e
-
SHA1
7f3e37b6f4083f936af217dd75307c0b3313f0fd
-
SHA256
c5d4f27e2805a98e80299d6a1c0c811ec883c5cbb3f52843a8ca680407e2fc59
-
SHA512
2f836b195cf09003df5054b4ae883f9cf7b38022dea6b2c72af9791c2cd0cfc28eb4b28eb69ce064b64b7bf3d8111312b97fa57613ffbf885363b93858adeee5
-
SSDEEP
24576:DqDEvCTbMWu7rQYlBQcBiT6rprG8al5LQoxdqBMR:DTvC/MTQYxsWR7aleWqBM
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-