General
-
Target
da049cf547f66a701590bd333a9d61d0f7c448e3b798018f3d50497cc94445c7.exe
-
Size
1.3MB
-
Sample
240919-b8vvbavcrl
-
MD5
a8371130da53aa606d8c72201192ee47
-
SHA1
3190b84eae50e45b78de3fa23b0de2541d73ea0b
-
SHA256
da049cf547f66a701590bd333a9d61d0f7c448e3b798018f3d50497cc94445c7
-
SHA512
0d849384b92eb807cfdcb1834d72b1506a5b73bd2c3fae09e291a71b0b0572737e1a2ceae0704b7ed89b3fdec386a516c5a1e907682e24caf0dc0c356ab44acb
-
SSDEEP
24576:uRmJkcoQricOIQxiZY1iaCzpQOAjXcup8W6xRnhI7Eoc7ehSc/cP:7JZoQrbTFZY1iaCzeOGsW89P/oNSz
Static task
static1
Behavioral task
behavioral1
Sample
da049cf547f66a701590bd333a9d61d0f7c448e3b798018f3d50497cc94445c7.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
da049cf547f66a701590bd333a9d61d0f7c448e3b798018f3d50497cc94445c7.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
da049cf547f66a701590bd333a9d61d0f7c448e3b798018f3d50497cc94445c7.exe
-
Size
1.3MB
-
MD5
a8371130da53aa606d8c72201192ee47
-
SHA1
3190b84eae50e45b78de3fa23b0de2541d73ea0b
-
SHA256
da049cf547f66a701590bd333a9d61d0f7c448e3b798018f3d50497cc94445c7
-
SHA512
0d849384b92eb807cfdcb1834d72b1506a5b73bd2c3fae09e291a71b0b0572737e1a2ceae0704b7ed89b3fdec386a516c5a1e907682e24caf0dc0c356ab44acb
-
SSDEEP
24576:uRmJkcoQricOIQxiZY1iaCzpQOAjXcup8W6xRnhI7Eoc7ehSc/cP:7JZoQrbTFZY1iaCzeOGsW89P/oNSz
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-