Overview
overview
10Static
static
341f3f2ddba...22.exe
windows7-x64
1041f3f2ddba...22.exe
windows10-2004-x64
7$PLUGINSDI...qy.dll
windows7-x64
1$PLUGINSDI...qy.dll
windows10-2004-x64
1emteyvnnuao.ti
windows7-x64
3emteyvnnuao.ti
windows10-2004-x64
3xoxpvgducyg.a
windows7-x64
3xoxpvgducyg.a
windows10-2004-x64
3General
-
Target
41f3f2ddba5d6c64f4052044b5b15126bfdc76a93c69e8fd8c53600231b63422.exe
-
Size
274KB
-
Sample
240630-yzajcaxejq
-
MD5
5f3fa7bb31fd433cc4db6617c2bf0f3a
-
SHA1
b905fc4d2d08e63af9ce0c7b71c80ebbe1288792
-
SHA256
41f3f2ddba5d6c64f4052044b5b15126bfdc76a93c69e8fd8c53600231b63422
-
SHA512
6a93553be540bdb53b30e61c932516cdb1847c1a63bfcb88fcd4560b4fb0208757e4fcb5d96aa952e3a05132da446f5c7270ef204846df688cc2e81338bd793a
-
SSDEEP
6144:yYa6BqUJ5kppEFINKIPm6ggF97LGj7kn9ogk4X:yYfRuppESSgo7k3X
Static task
static1
Behavioral task
behavioral1
Sample
41f3f2ddba5d6c64f4052044b5b15126bfdc76a93c69e8fd8c53600231b63422.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
41f3f2ddba5d6c64f4052044b5b15126bfdc76a93c69e8fd8c53600231b63422.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/zhwzxmwaqy.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/zhwzxmwaqy.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
emteyvnnuao.ti
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
emteyvnnuao.ti
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
xoxpvgducyg.a
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
xoxpvgducyg.a
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
41f3f2ddba5d6c64f4052044b5b15126bfdc76a93c69e8fd8c53600231b63422.exe
-
Size
274KB
-
MD5
5f3fa7bb31fd433cc4db6617c2bf0f3a
-
SHA1
b905fc4d2d08e63af9ce0c7b71c80ebbe1288792
-
SHA256
41f3f2ddba5d6c64f4052044b5b15126bfdc76a93c69e8fd8c53600231b63422
-
SHA512
6a93553be540bdb53b30e61c932516cdb1847c1a63bfcb88fcd4560b4fb0208757e4fcb5d96aa952e3a05132da446f5c7270ef204846df688cc2e81338bd793a
-
SSDEEP
6144:yYa6BqUJ5kppEFINKIPm6ggF97LGj7kn9ogk4X:yYfRuppESSgo7k3X
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/zhwzxmwaqy.dll
-
Size
11KB
-
MD5
6165588ec3553b2fa1f761c423d5fe09
-
SHA1
558f27f32c70441f53a16847437eca0aa37418dc
-
SHA256
ad9c380477cf715de73690f9b332dd77eb13cea4d960381fab6043c1a4eea787
-
SHA512
94cfe4e303a1c45b2e13e43c918f223b1829e755b3cc213fca450fa51d74390e0a59d88fbdfc22430111667f015f1c8f8d3b8f1704f0ad1106254781e4eb498f
-
SSDEEP
192:y5n4z5TxDVI+aRtFDP+qfaSddz0rCt3fc5B1Q1aJo:yV4zmXPDiSddgHi
Score1/10 -
-
-
Target
emteyvnnuao.ti
-
Size
8KB
-
MD5
a59b952d8751c809c4830ae96f5035d7
-
SHA1
77b1d1d0da42ccaa10228e5aba749dcd36c2cafe
-
SHA256
a507c46889e57fe768b404d9f76996e07ef7952515dbaf3391292dac420fab45
-
SHA512
69d2e37c1438b439416f2230ad1bdd73904b02ad8c859575728b0166def68831d1f4a67c5f06101c5747d47da1b1599c47523c235d495fa20be010c721ee56a3
-
SSDEEP
192:LWTtJD/vGJbz1z8T5abho60npolCORPlmrYA1OgU5sPdpZPvlcwM:KTtJLQb5z8T5abu6CalCORfA1TFpZHla
Score3/10 -
-
-
Target
xoxpvgducyg.a
-
Size
263KB
-
MD5
ab80c860ddf234f58f8eae5b05f8753c
-
SHA1
d6e08550c3339d61dd07e49d4785406124090591
-
SHA256
81dcba6db6ae4eef2c2f6ba562d4fd3ad4f2b336544e5ca730c3283c79e48ac0
-
SHA512
62883952905dad7c8cc4fd7145e41fab0f9e1b1baade0b48a03b1370fde670c988360c7582a234709efadd7cd8a19192d09ccb1e4d510d88c92525b31ffd2176
-
SSDEEP
6144:Cqe2ya9apTnbaFvYWxgV6JFoVAHLWMZQ+Y0OXaaLyOM/VAY:CdaQAKVhWVZ5Y3XaaWOMNb
Score3/10 -