General
-
Target
PAYMENT BANK INSTRUCTIONS COPY.exe
-
Size
478KB
-
Sample
211021-q6pylsadd3
-
MD5
3087381212aa30da9121ca4fce4dc49c
-
SHA1
d705ee1d3e4be5523d137bafbd4ea87f7c77f057
-
SHA256
0ba4135b330637a98320e9ee0655cd3fa0423998e9fdf54b0e8e0ac85ba0f93f
-
SHA512
4f07a2c6b7b9e4ee31d2133dfb420782a23b23d96c34197cadc2003d765ad46a4bd99231e01494ca918edcfbba0a67201934aae7fd03c1f6a42f119f9560c61b
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT BANK INSTRUCTIONS COPY.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
PAYMENT BANK INSTRUCTIONS COPY.exe
Resource
win10-en-20210920
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
sg2plcpnl0023.prod.sin2.secureserver.net - Port:
587 - Username:
nbsupports@seshsupports.com - Password:
User@40378
Targets
-
-
Target
PAYMENT BANK INSTRUCTIONS COPY.exe
-
Size
478KB
-
MD5
3087381212aa30da9121ca4fce4dc49c
-
SHA1
d705ee1d3e4be5523d137bafbd4ea87f7c77f057
-
SHA256
0ba4135b330637a98320e9ee0655cd3fa0423998e9fdf54b0e8e0ac85ba0f93f
-
SHA512
4f07a2c6b7b9e4ee31d2133dfb420782a23b23d96c34197cadc2003d765ad46a4bd99231e01494ca918edcfbba0a67201934aae7fd03c1f6a42f119f9560c61b
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-