General
-
Target
785963.exe
-
Size
785KB
-
Sample
211019-hrjt2sfda5
-
MD5
5ca59947026aa9ae631704ce604eaa5f
-
SHA1
f7743be57e66c79397a2d607a0a20383835a9e1a
-
SHA256
d60a45b44a0800df38057447057dbb5e6107e21b8000d98fb1cdb0acef3ccffa
-
SHA512
4e5cfcb4c78028af08a107eb6d9b33b7f2f3f16c2c60b40bcc552cced956960dfda546611f8c703d10aa4dc09f4f6b1460551b68c1294a9ed8974345719d4ac6
Static task
static1
Behavioral task
behavioral1
Sample
785963.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
785963.exe
Resource
win10-en-20210920
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.merchantexint.com - Port:
587 - Username:
[email protected] - Password:
merW&13@
Targets
-
-
Target
785963.exe
-
Size
785KB
-
MD5
5ca59947026aa9ae631704ce604eaa5f
-
SHA1
f7743be57e66c79397a2d607a0a20383835a9e1a
-
SHA256
d60a45b44a0800df38057447057dbb5e6107e21b8000d98fb1cdb0acef3ccffa
-
SHA512
4e5cfcb4c78028af08a107eb6d9b33b7f2f3f16c2c60b40bcc552cced956960dfda546611f8c703d10aa4dc09f4f6b1460551b68c1294a9ed8974345719d4ac6
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-