General
-
Target
P0#2OO1.bat
-
Size
810KB
-
Sample
211021-wzxb1abedq
-
MD5
9b6f28e79adb0f823a8d479748ef8f29
-
SHA1
cf38fff6222184fe32f1fb9277023486ebd8b425
-
SHA256
b0e5ea1139cd09a6005b124fdbda2e8e1657a66b7c068bc4ed017ac5dd473355
-
SHA512
eff2319cc57e341fe30d3f97eb6624ff44b9460063f32477681eed0f8155a7a24d491f5c1e3dfd5a8548e9f91b62561f8157946c7ee242630b8cf97d861d0ddc
Static task
static1
Behavioral task
behavioral1
Sample
P0#2OO1.bat.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
P0#2OO1.bat.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.msjfurniturewll.com - Port:
587 - Username:
shyam@msjfurniturewll.com - Password:
abc@1234!5
Targets
-
-
Target
P0#2OO1.bat
-
Size
810KB
-
MD5
9b6f28e79adb0f823a8d479748ef8f29
-
SHA1
cf38fff6222184fe32f1fb9277023486ebd8b425
-
SHA256
b0e5ea1139cd09a6005b124fdbda2e8e1657a66b7c068bc4ed017ac5dd473355
-
SHA512
eff2319cc57e341fe30d3f97eb6624ff44b9460063f32477681eed0f8155a7a24d491f5c1e3dfd5a8548e9f91b62561f8157946c7ee242630b8cf97d861d0ddc
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-