General
-
Target
DOCUMENTS.exe
-
Size
953KB
-
Sample
200714-wz6p1188xe
-
MD5
49a624292ca84737cc6c1318ba79c37f
-
SHA1
22dd3f01d20fda38ef2d9baf892837aba7c4ce30
-
SHA256
f84fb6d4efc2d260e4afc8515a01646621b32a5a8e767d7f0056a3e3f0f9aacb
-
SHA512
4f841d11bfc3f3e334a0929c7e5eae540d91c65d38ba912e127293d4999c1d34f7ee9caf70f6b7419af28a3c555531da9dab111a8aa2604cfc3f352708e80c5b
Static task
static1
Behavioral task
behavioral1
Sample
DOCUMENTS.exe
Resource
win7
Behavioral task
behavioral2
Sample
DOCUMENTS.exe
Resource
win10v200430
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.varda.com.tr - Port:
587 - Username:
[email protected] - Password:
varda9997929
Targets
-
-
Target
DOCUMENTS.exe
-
Size
953KB
-
MD5
49a624292ca84737cc6c1318ba79c37f
-
SHA1
22dd3f01d20fda38ef2d9baf892837aba7c4ce30
-
SHA256
f84fb6d4efc2d260e4afc8515a01646621b32a5a8e767d7f0056a3e3f0f9aacb
-
SHA512
4f841d11bfc3f3e334a0929c7e5eae540d91c65d38ba912e127293d4999c1d34f7ee9caf70f6b7419af28a3c555531da9dab111a8aa2604cfc3f352708e80c5b
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-