General
-
Target
Payment Advice.exe
-
Size
1.1MB
-
Sample
210511-5cpljbt2xj
-
MD5
e6fd86b4d700cf206695b3bc5d37401a
-
SHA1
967a7f18033fdfdae7d6768c4adbe8573e065a83
-
SHA256
9f5246d9c9dc30f30f1ad1ffaa3e3a5e4b81f51d2b9059527190cd3a55523eb1
-
SHA512
f22097cf9952e040152f470e7d21315e3444546cb2bfa6e7f0f8a46599f026107534208e44fcf3b6e47ad65924570b5736f1cbc4ee839edfa32f510adc845608
Static task
static1
Behavioral task
behavioral1
Sample
Payment Advice.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Payment Advice.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.amarantbg.com - Port:
587 - Username:
office@amarantbg.com - Password:
Office123
Targets
-
-
Target
Payment Advice.exe
-
Size
1.1MB
-
MD5
e6fd86b4d700cf206695b3bc5d37401a
-
SHA1
967a7f18033fdfdae7d6768c4adbe8573e065a83
-
SHA256
9f5246d9c9dc30f30f1ad1ffaa3e3a5e4b81f51d2b9059527190cd3a55523eb1
-
SHA512
f22097cf9952e040152f470e7d21315e3444546cb2bfa6e7f0f8a46599f026107534208e44fcf3b6e47ad65924570b5736f1cbc4ee839edfa32f510adc845608
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-