General
-
Target
Chaser Temp CRACKED.zip
-
Size
4.5MB
-
Sample
240903-mslggsvamm
-
MD5
110ef86686ba4be41314e43de2462cd8
-
SHA1
3b9e33319f8693d32ac3fe1a0a75b0afb478de1a
-
SHA256
c037429f30412b9308880840a0a5ee836ddd685e1af97c67853fed62308516c7
-
SHA512
e5d94bbb8fe50f03391bf37c609d015d4653f1c055c4d15cd93a7ed167271afd3a08530be73d6d62198970e49c2909bff9345ffeff122f313494fcf5f56921ee
-
SSDEEP
98304:D8JQ9csmb+XU5lemYidFoJjNKdSkGa72mqE2mTgbNJNLzxQcgwH382I/nnD:D8JQWFb5ThvouAbBDnDgi82IfD
Static task
static1
Malware Config
Targets
-
-
Target
Chaser Temp CRACKED.zip
-
Size
4.5MB
-
MD5
110ef86686ba4be41314e43de2462cd8
-
SHA1
3b9e33319f8693d32ac3fe1a0a75b0afb478de1a
-
SHA256
c037429f30412b9308880840a0a5ee836ddd685e1af97c67853fed62308516c7
-
SHA512
e5d94bbb8fe50f03391bf37c609d015d4653f1c055c4d15cd93a7ed167271afd3a08530be73d6d62198970e49c2909bff9345ffeff122f313494fcf5f56921ee
-
SSDEEP
98304:D8JQ9csmb+XU5lemYidFoJjNKdSkGa72mqE2mTgbNJNLzxQcgwH382I/nnD:D8JQWFb5ThvouAbBDnDgi82IfD
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-