General
-
Target
210706 RFQ of New Project(Yuanfang W339-25)_Rev1.exe
-
Size
1.3MB
-
Sample
211018-lhmq5adcg6
-
MD5
b03c62beb813436c42e00544acd49bdb
-
SHA1
f7e4c81eb07e29943dc270f4323c8a105a9d459e
-
SHA256
ac8b2c0172a6ebd98b661af827f42d283df366866d22817180922b64dab795d2
-
SHA512
4acca168ed74597b736d6328965a55ad65b3f8de904a2470c90ed304da7069bebd83ed6a0c0d1fa404e3d995371752cbd748f44f4a2435cdca645bafde4444b3
Static task
static1
Behavioral task
behavioral1
Sample
210706 RFQ of New Project(Yuanfang W339-25)_Rev1.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
210706 RFQ of New Project(Yuanfang W339-25)_Rev1.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.yillyenterprise.com - Port:
587 - Username:
[email protected] - Password:
Iseeyou.com
Targets
-
-
Target
210706 RFQ of New Project(Yuanfang W339-25)_Rev1.exe
-
Size
1.3MB
-
MD5
b03c62beb813436c42e00544acd49bdb
-
SHA1
f7e4c81eb07e29943dc270f4323c8a105a9d459e
-
SHA256
ac8b2c0172a6ebd98b661af827f42d283df366866d22817180922b64dab795d2
-
SHA512
4acca168ed74597b736d6328965a55ad65b3f8de904a2470c90ed304da7069bebd83ed6a0c0d1fa404e3d995371752cbd748f44f4a2435cdca645bafde4444b3
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-