General
-
Target
27840a87db8fe5f9d73b741f7c9d6e0d40d44d3733da053d2d26019398d17d76
-
Size
1.2MB
-
Sample
240727-bjhtfsxank
-
MD5
3e940e51c2f61cd8482764ab788fc29c
-
SHA1
0190e8e9ea92aaab23cca316d1e55eef31bb4f2d
-
SHA256
27840a87db8fe5f9d73b741f7c9d6e0d40d44d3733da053d2d26019398d17d76
-
SHA512
8f0b59f1d46d8232cb150a9d7500022e37cac435291d0b4e93ccc7a937dc32d507f193768d55922fedb68402901f6def02f56772a05910d3bc01853c3c069574
-
SSDEEP
24576:8qDEvCTbMWu7rQYlBQcBiT6rprG8aALarseL2ZFj8Zen86:8TvC/MTQYxsWR7aALZR8Zg8
Static task
static1
Behavioral task
behavioral1
Sample
27840a87db8fe5f9d73b741f7c9d6e0d40d44d3733da053d2d26019398d17d76.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
27840a87db8fe5f9d73b741f7c9d6e0d40d44d3733da053d2d26019398d17d76.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
27840a87db8fe5f9d73b741f7c9d6e0d40d44d3733da053d2d26019398d17d76
-
Size
1.2MB
-
MD5
3e940e51c2f61cd8482764ab788fc29c
-
SHA1
0190e8e9ea92aaab23cca316d1e55eef31bb4f2d
-
SHA256
27840a87db8fe5f9d73b741f7c9d6e0d40d44d3733da053d2d26019398d17d76
-
SHA512
8f0b59f1d46d8232cb150a9d7500022e37cac435291d0b4e93ccc7a937dc32d507f193768d55922fedb68402901f6def02f56772a05910d3bc01853c3c069574
-
SSDEEP
24576:8qDEvCTbMWu7rQYlBQcBiT6rprG8aALarseL2ZFj8Zen86:8TvC/MTQYxsWR7aALZR8Zg8
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-