General
-
Target
cda5c7299b8e0d3d7c4d16bc5d8a79bd.rar
-
Size
380KB
-
Sample
211021-nb68asbafk
-
MD5
cda5c7299b8e0d3d7c4d16bc5d8a79bd
-
SHA1
e55bb2f8359dea973be46dec83f8f0e4ad8ec049
-
SHA256
7260f521f888039c4c336f402f915c836c38e26b68c4e0ec61238848e567a876
-
SHA512
5972b87217704d5ae3b018802f0da6aa2f9c5bb0ce475841991b6533dd6938443635f7d7664c971db5c7f3a52fe06ffed2cbdb6ada800d4aaeafe6366eccefb9
Static task
static1
Behavioral task
behavioral1
Sample
Request for quotation (RFQ) pdf.exe
Resource
win10-en-20210920
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
srodriguez@beticco.com - Password:
C%)%GWZe9
Targets
-
-
Target
Request for quotation (RFQ) pdf.exe
-
Size
443KB
-
MD5
8fae956cfdd27697a8745eabf8bcb1b7
-
SHA1
8d1d36677c019a278c424fce5d82757c28988dda
-
SHA256
eb1787166fb170e5c3b3c0761d22b2263bb86361bab75d2cad1ebf1d8395a1dd
-
SHA512
357e737f3bd4336ef6d62a37e36b7099e847818b2098691014bca69913a84e2416e88adea6e750b93fc0d9505d5c8faaeb999e039d57792ced75760791dac138
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-