General
-
Target
PO.30023120.exe
-
Size
780KB
-
Sample
211020-xj7y8sadel
-
MD5
ee3e9c5a4defe801b65945bc719712eb
-
SHA1
05c78d06e003ae66d50470424c4b2f4fc12a588b
-
SHA256
4ec534a56242b9fce084489c530b3c148b5f88e139e98d06b630fe1404c09946
-
SHA512
734e97fa19004644b29d57f6d5024d5f16b12a7c56e6930f873e1d6b4a94b7f20fbbf9fc96eaff98baf4bea0943f523fa15b9f37ecd0e4d8b876d868ce0e55e8
Static task
static1
Behavioral task
behavioral1
Sample
PO.30023120.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
PO.30023120.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.aldhiyafainteriors.com - Port:
587 - Username:
rahman@aldhiyafainteriors.com - Password:
dhiyafa@987
Targets
-
-
Target
PO.30023120.exe
-
Size
780KB
-
MD5
ee3e9c5a4defe801b65945bc719712eb
-
SHA1
05c78d06e003ae66d50470424c4b2f4fc12a588b
-
SHA256
4ec534a56242b9fce084489c530b3c148b5f88e139e98d06b630fe1404c09946
-
SHA512
734e97fa19004644b29d57f6d5024d5f16b12a7c56e6930f873e1d6b4a94b7f20fbbf9fc96eaff98baf4bea0943f523fa15b9f37ecd0e4d8b876d868ce0e55e8
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-