General
-
Target
Quotation#73280126721_Oriental_Fastech_Manufacturing.exe
-
Size
763KB
-
Sample
210426-g45atbvjfj
-
MD5
37b814b74d28b26217d2d4b77ad2abc3
-
SHA1
3df36477b86c9f882aedd0d3a1b6d82f3da1136b
-
SHA256
8e8b3b7c12c9e7113b882eb559fe9fd5cac868f8e3238942bcc9fa893521c5a4
-
SHA512
a261e85a645915f6268fc21cf06b0478b0c41c55768ea4d868a2b469f441895a37d22447adaf2bc15071c8807087255ea060e9caf83e47ec688b85a866d047bc
Static task
static1
Behavioral task
behavioral1
Sample
Quotation#73280126721_Oriental_Fastech_Manufacturing.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Quotation#73280126721_Oriental_Fastech_Manufacturing.exe
Resource
win10v20210408
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
aammorris@askoblue.com - Password:
hbqtHu^3
Targets
-
-
Target
Quotation#73280126721_Oriental_Fastech_Manufacturing.exe
-
Size
763KB
-
MD5
37b814b74d28b26217d2d4b77ad2abc3
-
SHA1
3df36477b86c9f882aedd0d3a1b6d82f3da1136b
-
SHA256
8e8b3b7c12c9e7113b882eb559fe9fd5cac868f8e3238942bcc9fa893521c5a4
-
SHA512
a261e85a645915f6268fc21cf06b0478b0c41c55768ea4d868a2b469f441895a37d22447adaf2bc15071c8807087255ea060e9caf83e47ec688b85a866d047bc
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-