General
-
Target
BONI APRIL_crypted.exe
-
Size
633KB
-
Sample
210420-v63kq99thn
-
MD5
a58b1f671d949136a3ca0176b937c04e
-
SHA1
7c5581a992aaa9928a9d220710da89b7c90287bf
-
SHA256
de7ce4352b90f87944e8edac1f451c4088f6394b3d2c186c721ad00d9fab4370
-
SHA512
5e6861d0dd5ee3d851bb0ec621b7057c2059d91c1ce81d0d05a2588a588d9e8cd02ccd4d0bb023064f81c9dbc348c51b4d2716e699373445c3970db11ac7d8f9
Static task
static1
Behavioral task
behavioral1
Sample
BONI APRIL_crypted.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
BONI APRIL_crypted.exe
Resource
win10v20210408
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
a2plcpnl0347.prod.iad2.secureserver.net - Port:
587 - Username:
[email protected] - Password:
Admin_123
Targets
-
-
Target
BONI APRIL_crypted.exe
-
Size
633KB
-
MD5
a58b1f671d949136a3ca0176b937c04e
-
SHA1
7c5581a992aaa9928a9d220710da89b7c90287bf
-
SHA256
de7ce4352b90f87944e8edac1f451c4088f6394b3d2c186c721ad00d9fab4370
-
SHA512
5e6861d0dd5ee3d851bb0ec621b7057c2059d91c1ce81d0d05a2588a588d9e8cd02ccd4d0bb023064f81c9dbc348c51b4d2716e699373445c3970db11ac7d8f9
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-