General
-
Target
Bank slip.exe
-
Size
694KB
-
Sample
211019-jdh62agcdm
-
MD5
cb84e6082cec4afda05807eb8c5d62e9
-
SHA1
ca66b1a86f68e660c428aa46ca6d00c226e72503
-
SHA256
a965a0da37d19d72e2a468560846917d1e69d396f6622c77103a1c25b26c1100
-
SHA512
2a21d2b4d4a8652806a3d90b183a9a7d41740904314543e74a50765be80fc67ff2804349a454c99b347d0552cf1556195c9bb42ec47baade3e41741eaff922c4
Static task
static1
Behavioral task
behavioral1
Sample
Bank slip.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Bank slip.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
!xgapua3
Targets
-
-
Target
Bank slip.exe
-
Size
694KB
-
MD5
cb84e6082cec4afda05807eb8c5d62e9
-
SHA1
ca66b1a86f68e660c428aa46ca6d00c226e72503
-
SHA256
a965a0da37d19d72e2a468560846917d1e69d396f6622c77103a1c25b26c1100
-
SHA512
2a21d2b4d4a8652806a3d90b183a9a7d41740904314543e74a50765be80fc67ff2804349a454c99b347d0552cf1556195c9bb42ec47baade3e41741eaff922c4
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-