General
-
Target
4300008980.r17
-
Size
401KB
-
Sample
211021-gs7rtshhb6
-
MD5
73d6f5071697e0ebc2e4a6c8ddd433d6
-
SHA1
0966d74121ebfc5b70b5bd2696333cf4af0acdfd
-
SHA256
246def63063f79dd9c8e15eae453515ee1da9dd829feb96434bdf1ff0caf8ada
-
SHA512
2132d3c1f43a10815c16d6082f1d636e2d884e5a073da791984b7aa550008a0010f7755c9e08a71d54efa3ae09ed8338ab954b83f6b5734a2bca69a5934ab691
Static task
static1
Behavioral task
behavioral1
Sample
4300008980.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
4300008980.exe
Resource
win10-en-20210920
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
sandra.hurm@voestallpine.com - Password:
project2021blessing
Targets
-
-
Target
4300008980.exe
-
Size
459KB
-
MD5
de8e80d61ed0665c6cfec2122e11d6c7
-
SHA1
97ca477c06676e1b72db3c38654f88f42b805866
-
SHA256
6332ce856a353587019ae83e767a515552e4d7a36ac631ebc2c292185850b5d7
-
SHA512
7268d9455636d92c776969e7dfc45fd453aa21f59b76a9d25499d8ebd3fdda829aebcc1b72e5afb50e6060bc7c3c200956e36fbe16be5177f70a4ad719928a9e
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-