General
-
Target
PO#33S2-202105BsNR.zip
-
Size
937KB
-
Sample
210416-5ghaxvwf5s
-
MD5
bdf67bed997dcf964142dd45c069f615
-
SHA1
0c006b7bffee84b6d9d55fad0695a86d82f2646c
-
SHA256
51ffadb235d5d1dac55f0112aee9612c64c5bbd31292b1723b56c92743c88116
-
SHA512
0e624a1e4b1155801da3c2c32b1181e413c677fe5a17963264ef60faec71c5deb50fae96be3e1fbe1240de5987810776f371c184f22ca0d0f1cb570d0a59969e
Static task
static1
Behavioral task
behavioral1
Sample
PO#33S2-202105BsNR.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
PO#33S2-202105BsNR.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.mesco-midhco.com - Port:
587 - Username:
[email protected] - Password:
fFEawV%0
Targets
-
-
Target
PO#33S2-202105BsNR.exe
-
Size
1.1MB
-
MD5
5dcb9230b7b1fd6a6af46cd3a6b8f7dc
-
SHA1
accfe3b4df5722111a54d0a225e56522c7a0b1d4
-
SHA256
d8e652da86fdd7a46e480f4e80616abc1f6ea80a1bfa00bbf70414dac7895480
-
SHA512
c986d1e6f5561949af2943f7f97bfd3ab5085da1e117ee40d72e9a0d359a85ae45e88162311d96804251f57f60c413467a794ee792607e398eb6df32ed89ab0b
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-