General
-
Target
41f3f2ddba5d6c64f4052044b5b15126bfdc76a93c69e8fd8c53600231b63422.exe
-
Size
274KB
-
Sample
240705-hjqydstflp
-
MD5
5f3fa7bb31fd433cc4db6617c2bf0f3a
-
SHA1
b905fc4d2d08e63af9ce0c7b71c80ebbe1288792
-
SHA256
41f3f2ddba5d6c64f4052044b5b15126bfdc76a93c69e8fd8c53600231b63422
-
SHA512
6a93553be540bdb53b30e61c932516cdb1847c1a63bfcb88fcd4560b4fb0208757e4fcb5d96aa952e3a05132da446f5c7270ef204846df688cc2e81338bd793a
-
SSDEEP
6144:yYa6BqUJ5kppEFINKIPm6ggF97LGj7kn9ogk4X:yYfRuppESSgo7k3X
Static task
static1
Behavioral task
behavioral1
Sample
41f3f2ddba5d6c64f4052044b5b15126bfdc76a93c69e8fd8c53600231b63422.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
41f3f2ddba5d6c64f4052044b5b15126bfdc76a93c69e8fd8c53600231b63422.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/zhwzxmwaqy.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/zhwzxmwaqy.dll
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
41f3f2ddba5d6c64f4052044b5b15126bfdc76a93c69e8fd8c53600231b63422.exe
-
Size
274KB
-
MD5
5f3fa7bb31fd433cc4db6617c2bf0f3a
-
SHA1
b905fc4d2d08e63af9ce0c7b71c80ebbe1288792
-
SHA256
41f3f2ddba5d6c64f4052044b5b15126bfdc76a93c69e8fd8c53600231b63422
-
SHA512
6a93553be540bdb53b30e61c932516cdb1847c1a63bfcb88fcd4560b4fb0208757e4fcb5d96aa952e3a05132da446f5c7270ef204846df688cc2e81338bd793a
-
SSDEEP
6144:yYa6BqUJ5kppEFINKIPm6ggF97LGj7kn9ogk4X:yYfRuppESSgo7k3X
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/zhwzxmwaqy.dll
-
Size
11KB
-
MD5
6165588ec3553b2fa1f761c423d5fe09
-
SHA1
558f27f32c70441f53a16847437eca0aa37418dc
-
SHA256
ad9c380477cf715de73690f9b332dd77eb13cea4d960381fab6043c1a4eea787
-
SHA512
94cfe4e303a1c45b2e13e43c918f223b1829e755b3cc213fca450fa51d74390e0a59d88fbdfc22430111667f015f1c8f8d3b8f1704f0ad1106254781e4eb498f
-
SSDEEP
192:y5n4z5TxDVI+aRtFDP+qfaSddz0rCt3fc5B1Q1aJo:yV4zmXPDiSddgHi
Score1/10 -