General
- Target BOQ & SPECIFICATIONS.exe
- Size 554KB
- Sample200721-aae2tbh3ls
- SHA256 8a38416c96cd729c983630873174412ea5a61f140dfd6aaa1e88a6fbaa083002
- MD5 9f0eea125c8112fba571e60b1d6f5cb4
- SHA1 9aa5431a26956d34499c6418a64f9e93b37dc4ac
- SHA512 5799eb2681177a18da50e133083c7a71ee2cec847d87446a1b356a54e039cdd192c6b1d38a880ed47cc60c1b64ef10936c013eda250bbd342cf10b9fc3cbc492
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
BOQ & SPECIFICATIONS.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
BOQ & SPECIFICATIONS.exe
Resource
win10
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
challenge12345@
Targets
-
- Target BOQ & SPECIFICATIONS.exe
- Size 554KB
- SHA256 8a38416c96cd729c983630873174412ea5a61f140dfd6aaa1e88a6fbaa083002
- MD5 9f0eea125c8112fba571e60b1d6f5cb4
- SHA1 9aa5431a26956d34499c6418a64f9e93b37dc4ac
- SHA512 5799eb2681177a18da50e133083c7a71ee2cec847d87446a1b356a54e039cdd192c6b1d38a880ed47cc60c1b64ef10936c013eda250bbd342cf10b9fc3cbc492
- MD5 SHA1 SHA512
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
AgentTesla Payload
Adds Run key to start application
Suspicious use of SetThreadContext