General
-
Target
PO.r15
-
Size
493KB
-
Sample
210727-pebfx96qbn
-
MD5
718013df80ee2f710c0502069f243842
-
SHA1
e3f9aed868b39935f0c4ba1ba37e7673879579fe
-
SHA256
5c602bf190d06a7b541c9629bd48bb63745ef463c24e572c7a285f9891e507ec
-
SHA512
298e50993fffc7aa905f832196cae7acfdf4de8e638838a46497e9c770708799361d84c4c52368fbdb6e06f8c5eb2eadd8642b1fc2954dfd83373b211006156e
Static task
static1
Behavioral task
behavioral1
Sample
PO.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
PO.exe
Resource
win10v20210408
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.ndn.edu.lb - Port:
587 - Username:
chefcomptable@ndn.edu.lb - Password:
Lebanon-Achrafieh-39
Targets
-
-
Target
PO.exe
-
Size
633KB
-
MD5
ff5d0a2b5fa45ddcdb3471236adf7b9c
-
SHA1
9d03755918f0b8c9bc7436b96c480564574bb446
-
SHA256
e352fd57db8a0670353e1c3caf02fd7d83fb315bb2e519b48dccd27eb3a2c456
-
SHA512
44bc2df5a37745b6f19cc99482d6415452736ba74ee95e3278380069cef01c8ad390a00b4a804fbf132f69abec381c76554f05d1fcc73297a2bfdfc10f9a72d1
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-