General
-
Target
PO# 8200555939 21-ATKL52.tar.gz
-
Size
513KB
-
Sample
210728-sxm4z1txs2
-
MD5
5bfeeb9869707a07c3f4a88504a5a9e6
-
SHA1
3455df4359c34b2ca6696e421da718369de528fc
-
SHA256
948d9a811320e9a9e041f295aac6d8637e965303923ba2cba2fdc7c159d4788d
-
SHA512
cb5439d26433c003f4de0b6b4edafbe98c5b66c157d6aa78ae68f2ab857915137f3924165458d9dc3ce85cc726c69a41138a3e02c5bb9660b21292dd1262c121
Static task
static1
Behavioral task
behavioral1
Sample
0bf4527dbce68cdb15e9d7fab6229a3e.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
0bf4527dbce68cdb15e9d7fab6229a3e.exe
Resource
win10v20210408
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
PbQ)ubh9
Targets
-
-
Target
0bf4527dbce68cdb15e9d7fab6229a3e.exe
-
Size
701KB
-
MD5
beee421f170be70ca4efd8b81940e18b
-
SHA1
a124ee2194c9970275f2454899a5025f2887d9ad
-
SHA256
407a175b3d9735477868deec5907b8e9703abcd76799529d9e2354bdddde550b
-
SHA512
24e06abbf300b6da57e9617da07a89a404696cc6f97213d2c503ce2c90d49cc8186e2c8dfc49b9fc6172a69675b00ab298a34617bc1ae821af0a3854fe315893
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-