General
-
Target
PI.exe
-
Size
964KB
-
Sample
201121-p6tdx83n86
-
MD5
dbda32339a6965fefc794f220f944016
-
SHA1
3e53b09125eb1e031f5f0e777836ba738b84fc42
-
SHA256
c62b96f303f538748543747d1dacb97119dd9826b53ef6c8350b5b24d69f0006
-
SHA512
be3282f1211845289f41775cd423312efca1a5cccfa5bfbf5a4baa31bb55b6067b0d40db3f82113c0166998c4bfd9459699bd0673acc68e3c5320244513a05fb
Static task
static1
Behavioral task
behavioral1
Sample
PI.exe
Resource
win7v20201028
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.hybridgroupco.com - Port:
587 - Username:
info@hybridgroupco.com - Password:
Obinna123@@@
Extracted
Protocol: smtp- Host:
mail.hybridgroupco.com - Port:
587 - Username:
info@hybridgroupco.com - Password:
Obinna123@@@
Targets
-
-
Target
PI.exe
-
Size
964KB
-
MD5
dbda32339a6965fefc794f220f944016
-
SHA1
3e53b09125eb1e031f5f0e777836ba738b84fc42
-
SHA256
c62b96f303f538748543747d1dacb97119dd9826b53ef6c8350b5b24d69f0006
-
SHA512
be3282f1211845289f41775cd423312efca1a5cccfa5bfbf5a4baa31bb55b6067b0d40db3f82113c0166998c4bfd9459699bd0673acc68e3c5320244513a05fb
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops startup file
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-