General
-
Target
duk (1).exe
-
Size
602KB
-
Sample
201109-6h1kv1qk8e
-
MD5
fbc8fc31a49ac108bd3493cbe4c347b1
-
SHA1
d265831d472e059df1a86792e1e22cabe3e12425
-
SHA256
6e70926884bf8f8e7800764e8a08ed9656a3bb5efc7e94816967ffb322fde763
-
SHA512
1cdd2ef9756dbe519999174d44f2f3d26c4286095f855fc7e9e96b6fd582a3c84d6b577d8a5e44a45488a21deb6c363bc55a40acc72e996b69839ceb205e652e
Static task
static1
Behavioral task
behavioral1
Sample
duk (1).exe
Resource
win7v20201028
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.hotel71.com.bd - Port:
587 - Username:
chat@hotel71.com.bd - Password:
9+^va&phP1v9
Targets
-
-
Target
duk (1).exe
-
Size
602KB
-
MD5
fbc8fc31a49ac108bd3493cbe4c347b1
-
SHA1
d265831d472e059df1a86792e1e22cabe3e12425
-
SHA256
6e70926884bf8f8e7800764e8a08ed9656a3bb5efc7e94816967ffb322fde763
-
SHA512
1cdd2ef9756dbe519999174d44f2f3d26c4286095f855fc7e9e96b6fd582a3c84d6b577d8a5e44a45488a21deb6c363bc55a40acc72e996b69839ceb205e652e
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory
-
Suspicious use of SetThreadContext
-