General
-
Target
699adf49daa7dbd1e4bd58f741415d68148ad899.exe
-
Size
888KB
-
Sample
211019-lwrl8sgean
-
MD5
2659cfdc90835a44bdd248353adff686
-
SHA1
699adf49daa7dbd1e4bd58f741415d68148ad899
-
SHA256
1e3fba0ca8ada098611e59200a6f26d8c0b966f54aab1cc48991f8eb62f604eb
-
SHA512
fdb2388131b0298fe59f529b4611ba6bb7698e89376a9e61bfc6e14580b3a9d59c74024520d7a30daf05ce04fff34dffbf064bc72bed27b58f94cfa857c076db
Static task
static1
Behavioral task
behavioral1
Sample
699adf49daa7dbd1e4bd58f741415d68148ad899.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
699adf49daa7dbd1e4bd58f741415d68148ad899.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.mail.ru - Port:
587 - Username:
[email protected] - Password:
ykfSLYm2bvv69WJZjZtc
Targets
-
-
Target
699adf49daa7dbd1e4bd58f741415d68148ad899.exe
-
Size
888KB
-
MD5
2659cfdc90835a44bdd248353adff686
-
SHA1
699adf49daa7dbd1e4bd58f741415d68148ad899
-
SHA256
1e3fba0ca8ada098611e59200a6f26d8c0b966f54aab1cc48991f8eb62f604eb
-
SHA512
fdb2388131b0298fe59f529b4611ba6bb7698e89376a9e61bfc6e14580b3a9d59c74024520d7a30daf05ce04fff34dffbf064bc72bed27b58f94cfa857c076db
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-