General
-
Target
DeathCrypter-0.8.0.exe
-
Size
5.8MB
-
Sample
240902-rvqanstbkf
-
MD5
fe35580ad68344813946c7ac56f2d004
-
SHA1
407cbb184834ea4b379b082493359d513da62138
-
SHA256
a1351b3dbfc2dc4eafaad6f94cf007c3922ea57c69a89848c0bfb6ef93ee2c4c
-
SHA512
2f22217dabd8e85fa3d99f14feae3f781d5213ede6505c2acb6890cefc0ff45cbb163e015f1c084e3bc6cec627943211268ef2f07089df894cc854bc3256f236
-
SSDEEP
98304:NTz3yXmUTHPcIUwjCaZQHlt15lxy1N7PUB+4LIN8LijNL/MdYgFz/G/d3XQu9Ljl:NTz3Omg9UwGwA75n+N7PUBHlLWZAXz/c
Static task
static1
Malware Config
Targets
-
-
Target
DeathCrypter-0.8.0.exe
-
Size
5.8MB
-
MD5
fe35580ad68344813946c7ac56f2d004
-
SHA1
407cbb184834ea4b379b082493359d513da62138
-
SHA256
a1351b3dbfc2dc4eafaad6f94cf007c3922ea57c69a89848c0bfb6ef93ee2c4c
-
SHA512
2f22217dabd8e85fa3d99f14feae3f781d5213ede6505c2acb6890cefc0ff45cbb163e015f1c084e3bc6cec627943211268ef2f07089df894cc854bc3256f236
-
SSDEEP
98304:NTz3yXmUTHPcIUwjCaZQHlt15lxy1N7PUB+4LIN8LijNL/MdYgFz/G/d3XQu9Ljl:NTz3Omg9UwGwA75n+N7PUBHlLWZAXz/c
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-