General
-
Target
RPLTFL024962021.GZ
-
Size
440KB
-
Sample
211019-nnvp2afga5
-
MD5
a11db1c95e9d07492bcc91c2a67743c8
-
SHA1
286963ffd872af6f8818c6f7beb7033247149893
-
SHA256
1845ebd6aaa37eb8a9665af93db7b53e6133a864ba613a376882107d2b1b582c
-
SHA512
4f4682c7c0ef705db237f23f539fb837061414e6264afd52d89d3263b9e9506dc6060c8304a141ca0173456f4dae7ef8f9a24a5a31acbd8924f52f32f000ebd0
Static task
static1
Behavioral task
behavioral1
Sample
RPLTFL024962021.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
RPLTFL024962021.exe
Resource
win10-en-20210920
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
uscentral50.myserverhosts.com - Port:
587 - Username:
[email protected] - Password:
waters@789
Targets
-
-
Target
RPLTFL024962021.exe
-
Size
532KB
-
MD5
000b20cafe3744650b7247750d511876
-
SHA1
08204bead740b34c4628daf7888ac0a10db4d146
-
SHA256
de54f743f7013404a6b143790034fbdc9636f75dfb1d914c6c3176ade71d0e61
-
SHA512
5669912fa0e06a2e1a34466973e3e6028a83cf0ea7fe64fb5cd79878cb3a2cae01533acdd31d17051bd0baa739804c0af1bd57b0e78367863227155fc50f2f45
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-