General
-
Target
Sample Qoutation List.exe
-
Size
633KB
-
Sample
210408-9lx1jlaz36
-
MD5
1218f28671801dbd95ee8b75e2df092b
-
SHA1
4a8bfff915795b37b50b550ddddfab8b68cf28c5
-
SHA256
b544726a7092ac0a8c503181644850292e01b7245808815d800f85e008c533d5
-
SHA512
e4ef46505fab8215e36c6a88280ed3672f6089f98fcdee079826acf94336437ea87aa7d2c5b7e2c47e9116d983e49da7d33084066e36e2284c89dd1580446e90
Static task
static1
Behavioral task
behavioral1
Sample
Sample Qoutation List.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Sample Qoutation List.exe
Resource
win10v20201028
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.thinnartede.com - Port:
587 - Username:
rakris@thinnartede.com - Password:
QGzh%!$2
Targets
-
-
Target
Sample Qoutation List.exe
-
Size
633KB
-
MD5
1218f28671801dbd95ee8b75e2df092b
-
SHA1
4a8bfff915795b37b50b550ddddfab8b68cf28c5
-
SHA256
b544726a7092ac0a8c503181644850292e01b7245808815d800f85e008c533d5
-
SHA512
e4ef46505fab8215e36c6a88280ed3672f6089f98fcdee079826acf94336437ea87aa7d2c5b7e2c47e9116d983e49da7d33084066e36e2284c89dd1580446e90
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-