General
-
Target
7HCYDW.exe
-
Size
439KB
-
Sample
211018-ge7jxadbb2
-
MD5
df149dd69ac46dbfafd8194e3d10a6ab
-
SHA1
f15fae56c94c46576e7b656ea34d5eb42bd8fda4
-
SHA256
8715b90fdea709f60563d5cfad92a81de645f3241e25804e6b58e891a11e6192
-
SHA512
861f099e004e61391f51d2f2266f3d05130db1a817838a2e5e26ba586274593cafa751b88b7a549236131fd8dfaad67ff27ba071334e9202ebb3e3196db75ef8
Static task
static1
Behavioral task
behavioral1
Sample
7HCYDW.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
7HCYDW.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.alraedsecurity.com - Port:
587 - Username:
[email protected] - Password:
Alraed99pass@
Targets
-
-
Target
7HCYDW.exe
-
Size
439KB
-
MD5
df149dd69ac46dbfafd8194e3d10a6ab
-
SHA1
f15fae56c94c46576e7b656ea34d5eb42bd8fda4
-
SHA256
8715b90fdea709f60563d5cfad92a81de645f3241e25804e6b58e891a11e6192
-
SHA512
861f099e004e61391f51d2f2266f3d05130db1a817838a2e5e26ba586274593cafa751b88b7a549236131fd8dfaad67ff27ba071334e9202ebb3e3196db75ef8
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-