General
-
Target
Quotation#73280126721_Oriental_Fastech_Manufacturings.exe
-
Size
799KB
-
Sample
210426-792g26qesn
-
MD5
f62392434dafe03001593e0dc43bfaae
-
SHA1
d827ef768e8d470c2ced5af28aa3892e9969c9cf
-
SHA256
5ff8126fb4025c8587191a776a7d505f1bcc825f87a8e21266f55d5ff3f2cccb
-
SHA512
0d39eddb1ff2c14e8358f6a48d410915b220bedb1976cf7f3ad592859388f5b228adf3d60d36ebfae04364bb6cb83191f7f879d3edf22fde87067d4113e39529
Static task
static1
Behavioral task
behavioral1
Sample
Quotation#73280126721_Oriental_Fastech_Manufacturings.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Quotation#73280126721_Oriental_Fastech_Manufacturings.exe
Resource
win10v20210408
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
sammorris@askoblue.com - Password:
P)RTDOg8
Targets
-
-
Target
Quotation#73280126721_Oriental_Fastech_Manufacturings.exe
-
Size
799KB
-
MD5
f62392434dafe03001593e0dc43bfaae
-
SHA1
d827ef768e8d470c2ced5af28aa3892e9969c9cf
-
SHA256
5ff8126fb4025c8587191a776a7d505f1bcc825f87a8e21266f55d5ff3f2cccb
-
SHA512
0d39eddb1ff2c14e8358f6a48d410915b220bedb1976cf7f3ad592859388f5b228adf3d60d36ebfae04364bb6cb83191f7f879d3edf22fde87067d4113e39529
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-