General
-
Target
086A75D9682C5FD127AE14B5B6BEE28797F7D83890D077DB5580D37EF6E13EF1
-
Size
413KB
-
Sample
211019-kqzvzsgchq
-
MD5
42daf82fa6d818b499c60a8e688a5ae0
-
SHA1
b646a57d3255156a5510fc55a0c727339a79cd20
-
SHA256
086a75d9682c5fd127ae14b5b6bee28797f7d83890d077db5580d37ef6e13ef1
-
SHA512
b16149d4bcdb0c2239e9a92bfdb5c4df0e82f08c2df5a8637a859504a1f8bf47482f72c5251fda92d3cc166a9daa5685951445208677ddff5ea8fc3d6a92a84e
Static task
static1
Behavioral task
behavioral1
Sample
rKcYGbHqqjUGRo5.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
rKcYGbHqqjUGRo5.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.medicare-equipment.com - Port:
587 - Username:
[email protected] - Password:
AllTheBest777
Targets
-
-
Target
rKcYGbHqqjUGRo5.exe
-
Size
519KB
-
MD5
34442cce45a4466045fe1748ec4b652b
-
SHA1
74eb4fca763ed077169795e1a9d20a8d5d697e19
-
SHA256
bd17aef5a6e188bd70166012321f6e131a403a6b663df81be05d9f104a4718a7
-
SHA512
a5f1d55c1c9d0344cf5111a6438a49300c097fb8bf4350495d5c2795c6a547799fe5c5660af7b3f8e41d7aa77f255457ae29cfb9e3b0d7b03f989ac11c1ac5d6
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-