General
-
Target
9161bc0ac7fd107278182e5220134b057915525c78ef256713b9ef6a4ccab4b6
-
Size
83KB
-
Sample
210315-zyx7v56et6
-
MD5
43d6c3f16b3af2b31f6db8cf8702b5c8
-
SHA1
51a1010f9b54cb916474d288694a8255809f7843
-
SHA256
9161bc0ac7fd107278182e5220134b057915525c78ef256713b9ef6a4ccab4b6
-
SHA512
20a5cbb63445b08e08f9cc03152a2577f4e8a7f19d899c0aaac4450199305529c1d9cacacb8193b863d4d7c278dee2e32a1ee9083dccb39fb0bee42476e4238f
Static task
static1
Behavioral task
behavioral1
Sample
9161bc0ac7fd107278182e5220134b057915525c78ef256713b9ef6a4ccab4b6.pps
Resource
win7v20201028
Behavioral task
behavioral2
Sample
9161bc0ac7fd107278182e5220134b057915525c78ef256713b9ef6a4ccab4b6.pps
Resource
win10v20201028
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
@damienzy.xyz2240
Targets
-
-
Target
9161bc0ac7fd107278182e5220134b057915525c78ef256713b9ef6a4ccab4b6
-
Size
83KB
-
MD5
43d6c3f16b3af2b31f6db8cf8702b5c8
-
SHA1
51a1010f9b54cb916474d288694a8255809f7843
-
SHA256
9161bc0ac7fd107278182e5220134b057915525c78ef256713b9ef6a4ccab4b6
-
SHA512
20a5cbb63445b08e08f9cc03152a2577f4e8a7f19d899c0aaac4450199305529c1d9cacacb8193b863d4d7c278dee2e32a1ee9083dccb39fb0bee42476e4238f
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
AgentTesla Payload
-
Blocklisted process makes network request
-
Adds Run key to start application
-
Drops file in System32 directory
-