General
-
Target
Invoice Query & PAYMENT COPY.zip
-
Size
555KB
-
Sample
210420-624jjemqne
-
MD5
96c9c3ff820b259260e294077259aad7
-
SHA1
832d5fa4bce5a1804a0e7d6a67ef0e826c726cf6
-
SHA256
c015389d0fa4ef4d07c140c379d61cecfc1856bb7286b76c91ac00b48711fd89
-
SHA512
8215de4512e8e91e7f18b82fb4cf96ec3ab0ee474161ff64250d8f5a6fa7f988b918f9c1679cc3c4fbce28a30069501d2257f2b0d8424443a2441360741d8976
Static task
static1
Behavioral task
behavioral1
Sample
BONI APRIL_crypted.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
BONI APRIL_crypted.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
a2plcpnl0347.prod.iad2.secureserver.net - Port:
587 - Username:
[email protected] - Password:
Admin_123
Targets
-
-
Target
BONI APRIL_crypted.exe
-
Size
633KB
-
MD5
a58b1f671d949136a3ca0176b937c04e
-
SHA1
7c5581a992aaa9928a9d220710da89b7c90287bf
-
SHA256
de7ce4352b90f87944e8edac1f451c4088f6394b3d2c186c721ad00d9fab4370
-
SHA512
5e6861d0dd5ee3d851bb0ec621b7057c2059d91c1ce81d0d05a2588a588d9e8cd02ccd4d0bb023064f81c9dbc348c51b4d2716e699373445c3970db11ac7d8f9
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-