General
-
Target
rGLREodBAc3qMWW.exe
-
Size
402KB
-
Sample
211020-hpsn6sgfh4
-
MD5
789373b7e8bfc21a2acccaaf4926590d
-
SHA1
62c13ed0d5ab860cec8981fed0cc34e8d85243c0
-
SHA256
1183feed064c66f5321e3d89c985542fcff19f29fb9f859fde262e7b2678cbca
-
SHA512
120d6eddc36bfd7d732c30b3cc1c737e90c0eebbd87feb456fbfe8df914c7feaf3e538b13e1637196b95f8e0951ecca95702b6b030a3cb0f788b1a64bdb8c7f4
Static task
static1
Behavioral task
behavioral1
Sample
rGLREodBAc3qMWW.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
rGLREodBAc3qMWW.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1990818097:AAEwom4DVSnyX5nLZhtvlrvCnmzUsVj23cE/sendDocument
Targets
-
-
Target
rGLREodBAc3qMWW.exe
-
Size
402KB
-
MD5
789373b7e8bfc21a2acccaaf4926590d
-
SHA1
62c13ed0d5ab860cec8981fed0cc34e8d85243c0
-
SHA256
1183feed064c66f5321e3d89c985542fcff19f29fb9f859fde262e7b2678cbca
-
SHA512
120d6eddc36bfd7d732c30b3cc1c737e90c0eebbd87feb456fbfe8df914c7feaf3e538b13e1637196b95f8e0951ecca95702b6b030a3cb0f788b1a64bdb8c7f4
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-