General
-
Target
BANK COPY.exe
-
Size
485KB
-
Sample
211021-rm9z4sbcer
-
MD5
e6c4cc5d13cbcca766ec3f7370d3794d
-
SHA1
2fc631568b1d0202c9e637aac7331cb32575cf88
-
SHA256
dfe2eca5a711af26bcc1dd31db2d2dab3a65baffd35cf8bf0505dca19a21a7f5
-
SHA512
7fff07de70c7d53d5f4e59dcad42433f390fbd639e47b92f81e6d3d4ce7ea92c23f7f403f6bf1e56be7ab8b590273008f0da0f2294910f7fcf1769be82385ab4
Static task
static1
Behavioral task
behavioral1
Sample
BANK COPY.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
BANK COPY.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.vivaldi.net - Port:
587 - Username:
masterwork123oshe@vivaldi.net - Password:
payment@1234
Targets
-
-
Target
BANK COPY.exe
-
Size
485KB
-
MD5
e6c4cc5d13cbcca766ec3f7370d3794d
-
SHA1
2fc631568b1d0202c9e637aac7331cb32575cf88
-
SHA256
dfe2eca5a711af26bcc1dd31db2d2dab3a65baffd35cf8bf0505dca19a21a7f5
-
SHA512
7fff07de70c7d53d5f4e59dcad42433f390fbd639e47b92f81e6d3d4ce7ea92c23f7f403f6bf1e56be7ab8b590273008f0da0f2294910f7fcf1769be82385ab4
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-