General
-
Target
RFQ-41845597.exe
-
Size
554KB
-
Sample
211021-e8th2ahgg8
-
MD5
03ebac4b300318683abedd76cdb7bde6
-
SHA1
b475b0079d963fc7198cbc12f4f3447ce95da352
-
SHA256
9bca070ab37ea78134d5e9a5203521570bddd110e8ea8a620b702c71ecd89d54
-
SHA512
f9b68b6463872018f20f7fe39d94afe823bf5f47b188c90311c2f6e478822cac435fe7158307cfeb409b243d72d1e865cdc3024d6ca6461ea1bee4cc9d8a743e
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-41845597.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
RFQ-41845597.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.ananthahotels.com - Port:
587 - Username:
bookings@ananthahotels.com - Password:
india225@#
Targets
-
-
Target
RFQ-41845597.exe
-
Size
554KB
-
MD5
03ebac4b300318683abedd76cdb7bde6
-
SHA1
b475b0079d963fc7198cbc12f4f3447ce95da352
-
SHA256
9bca070ab37ea78134d5e9a5203521570bddd110e8ea8a620b702c71ecd89d54
-
SHA512
f9b68b6463872018f20f7fe39d94afe823bf5f47b188c90311c2f6e478822cac435fe7158307cfeb409b243d72d1e865cdc3024d6ca6461ea1bee4cc9d8a743e
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-