General
-
Target
FDA.rar
-
Size
551KB
-
Sample
210915-g52rcahhh3
-
MD5
3695e7eeca88b9a0e16351116eaf01b7
-
SHA1
b622030c36ce8bd32f42a805c2a26d4862571011
-
SHA256
02d0286cf02f434949e434e6a5d293f11d80991f35bf5650c444660382c1b3a1
-
SHA512
d38397a7a1aba224f2e7ae6340c4f5a02b761ba8dfd6c151d48889c93fd184317a2c607328a43af61a9fff96488e14f6ce4bb1a8dca64313696664e6c4f5c5b5
Static task
static1
Behavioral task
behavioral1
Sample
FDA.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
FDA.exe
Resource
win10v20210408
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.rosaritoindustries.com - Port:
587 - Username:
inquiry@rosaritoindustries.com - Password:
aircondivision2019
Targets
-
-
Target
FDA.exe
-
Size
1.0MB
-
MD5
08a652c3adb52cc860c1b35dc2838f23
-
SHA1
6d630ca20b831dfa6db2b33ea1f0a256a1d13e60
-
SHA256
63e6198cee195250e7ef3aedecfacdfeb6fdbce9e4f3fd9c1260ef67075819a3
-
SHA512
7df0d8df46a9b44652a239c969f2da6bc81f15b91cc6ecfef9b904caf27dc73fa37494113651931f5c866e1f8b42503279addb0d209997a13cd646421d198c5f
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-