General
-
Target
d.exe
-
Size
875KB
-
Sample
210718-r32rrfgg46
-
MD5
3437bbb0a6be653c667b3091671af69a
-
SHA1
5378934fb1364286a61b453479aafb3811a6c9ac
-
SHA256
21a650e682952584b3226d026f5ae19917fbea420ab8e3a7486610c368939a83
-
SHA512
40d80c76a4f5c0b09b0c332668ee5fad14f15108fb5f8c9ad261be47bc9e20874c890ec991844425445adb80443b06120e7b599e9420cbfb0ac2aefb9d6b4555
Static task
static1
Behavioral task
behavioral1
Sample
d.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
d.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yillmachine.com - Port:
587 - Username:
datalogs2020@yillmachine.com - Password:
FCcHFCp8
Targets
-
-
Target
d.exe
-
Size
875KB
-
MD5
3437bbb0a6be653c667b3091671af69a
-
SHA1
5378934fb1364286a61b453479aafb3811a6c9ac
-
SHA256
21a650e682952584b3226d026f5ae19917fbea420ab8e3a7486610c368939a83
-
SHA512
40d80c76a4f5c0b09b0c332668ee5fad14f15108fb5f8c9ad261be47bc9e20874c890ec991844425445adb80443b06120e7b599e9420cbfb0ac2aefb9d6b4555
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-