General
-
Target
Payment advice copy.exe
-
Size
467KB
-
Sample
211019-gd2x2afcd8
-
MD5
3ab45f980ca589bdbfd9762e11162e38
-
SHA1
f627731c1b0277e31d3969ab2c6fedfad8bf941a
-
SHA256
06bc9d1d35aaf5936952229ee7aa9bda01c1804118dd29b28a260f241b1724a8
-
SHA512
7267dcd07ba06153954be75531ebd4994b4820b561defb3279b043d343a25ddc9cf40d23deb67d228fc168b410fa02fe09daf00c4fae68c3cdc3cc703e4b9b19
Static task
static1
Behavioral task
behavioral1
Sample
Payment advice copy.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Payment advice copy.exe
Resource
win10-en-20210920
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.vector-kl.com - Port:
587 - Username:
[email protected] - Password:
VickyVectorKL202)
Targets
-
-
Target
Payment advice copy.exe
-
Size
467KB
-
MD5
3ab45f980ca589bdbfd9762e11162e38
-
SHA1
f627731c1b0277e31d3969ab2c6fedfad8bf941a
-
SHA256
06bc9d1d35aaf5936952229ee7aa9bda01c1804118dd29b28a260f241b1724a8
-
SHA512
7267dcd07ba06153954be75531ebd4994b4820b561defb3279b043d343a25ddc9cf40d23deb67d228fc168b410fa02fe09daf00c4fae68c3cdc3cc703e4b9b19
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-