General
-
Target
PO.exe
-
Size
633KB
-
Sample
210727-plw72qhsw6
-
MD5
ff5d0a2b5fa45ddcdb3471236adf7b9c
-
SHA1
9d03755918f0b8c9bc7436b96c480564574bb446
-
SHA256
e352fd57db8a0670353e1c3caf02fd7d83fb315bb2e519b48dccd27eb3a2c456
-
SHA512
44bc2df5a37745b6f19cc99482d6415452736ba74ee95e3278380069cef01c8ad390a00b4a804fbf132f69abec381c76554f05d1fcc73297a2bfdfc10f9a72d1
Static task
static1
Behavioral task
behavioral1
Sample
PO.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
PO.exe
Resource
win10v20210408
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.ndn.edu.lb - Port:
587 - Username:
[email protected] - Password:
Lebanon-Achrafieh-39
Targets
-
-
Target
PO.exe
-
Size
633KB
-
MD5
ff5d0a2b5fa45ddcdb3471236adf7b9c
-
SHA1
9d03755918f0b8c9bc7436b96c480564574bb446
-
SHA256
e352fd57db8a0670353e1c3caf02fd7d83fb315bb2e519b48dccd27eb3a2c456
-
SHA512
44bc2df5a37745b6f19cc99482d6415452736ba74ee95e3278380069cef01c8ad390a00b4a804fbf132f69abec381c76554f05d1fcc73297a2bfdfc10f9a72d1
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-