General
-
Target
70654 SSEBACT.zip
-
Size
366KB
-
Sample
211019-nmqdxsgfcr
-
MD5
6751c5bb80c904097510f5c2966a1ed1
-
SHA1
6bdf7e0e87c2ba4285e9cc9fd174a9dbdb7ce696
-
SHA256
429200fcff319513ff946fae51d5bb4500f969e02f5dcc02bc7333506b77635b
-
SHA512
73408da02d0b75c9a69e4cdcf26b23ad1d7ca0168a7d98d684e34f77fc6893b7c1620681db53864b6154ac3a8216916954a3d76f05323087d2820db98cc37c70
Static task
static1
Behavioral task
behavioral1
Sample
70654 SSEBACT.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
70654 SSEBACT.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.timsonlogisticske.com - Port:
587 - Username:
[email protected] - Password:
timsam2015
Targets
-
-
Target
70654 SSEBACT.exe
-
Size
389KB
-
MD5
54ad9166b1a65288183c4ee3a5fd0750
-
SHA1
36fad28b8c9b45a7b90c3f2fd4e5785b859e48ae
-
SHA256
faaa464df297e2bda628f86354e76da115e88941ec92386302a6cac74fecfca0
-
SHA512
3b9a58297ac116f94e8728a660cbb963c00722acb3c202ad23f7133eac2368bdbf665c32a1fa10b6f122dd5058113f54ed64fbfdfc1be66f7a701453aef59eba
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-