General
-
Target
Payment copy.exe
-
Size
463KB
-
Sample
211020-f2kszshegp
-
MD5
6c307d1258cf2683284c2d5ec52b09d7
-
SHA1
332c7e1d15e872bde3f7f82408b14069fafc37e6
-
SHA256
86f62c5e50414b4fe7620d4725e4bfc40957cdcb886aeae22d482ef7db7c2781
-
SHA512
eb1ff84f44fcb6f43d8a02f38cd130c31eb84863eb18c2c6558b360eb43cc1cd760148d4eda0114a4cf11030f926a0af507d351518e2c0da42911c5ccd7f665d
Static task
static1
Behavioral task
behavioral1
Sample
Payment copy.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
Payment copy.exe
Resource
win10-en-20210920
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
[email protected] - Password:
Everest10
Targets
-
-
Target
Payment copy.exe
-
Size
463KB
-
MD5
6c307d1258cf2683284c2d5ec52b09d7
-
SHA1
332c7e1d15e872bde3f7f82408b14069fafc37e6
-
SHA256
86f62c5e50414b4fe7620d4725e4bfc40957cdcb886aeae22d482ef7db7c2781
-
SHA512
eb1ff84f44fcb6f43d8a02f38cd130c31eb84863eb18c2c6558b360eb43cc1cd760148d4eda0114a4cf11030f926a0af507d351518e2c0da42911c5ccd7f665d
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-