General
-
Target
Outstanding Statement-0413.7z
-
Size
706KB
-
Sample
210420-pmvmchmnsx
-
MD5
92b3592c5d8d1637aa36701a52ed60a1
-
SHA1
789b220f62b8680e9b0157293ce8219a113bda2b
-
SHA256
4a6f5cd0562d515f27aace0fa5029f6408d6f712c627404df22bf34dc3408302
-
SHA512
c5fa37615f5ebd4cedb1f99bf61dc872daf78e788e683e94979d23a0019aa52f359581b788dc4e56a7081a2b5703de773146607fe6951fb5588760d97a9e4676
Static task
static1
Behavioral task
behavioral1
Sample
Outstanding Statement-0413.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Outstanding Statement-0413.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
webmail.mdist.us - Port:
587 - Username:
[email protected] - Password:
Jg#4321
Targets
-
-
Target
Outstanding Statement-0413.exe
-
Size
800KB
-
MD5
d1a4c4d05ecd22dc4911c2d2a95a4e05
-
SHA1
7566d86a447176a6a73ec6603df6a987da8681b1
-
SHA256
08caa9af8bc3d72fc768962c2319b86c9712a2437e6ca0e7cca8fc1049536def
-
SHA512
0d7f15d94f381ebcb14669f81d605709a37c2624559eb0b15a013f3703a626866ee74a6f71aad7980d7d4f3871ff18cec21ff3ebe48b9ee6efbaf698a93c0ea9
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-