General
-
Target
SecuriteInfo.com.Suspicious.Win32.Save.a.5480.4695
-
Size
879KB
-
Sample
211022-h1hncabcb4
-
MD5
365407f16ca457e0c46a0bbfd1333efb
-
SHA1
48d78f7e3f150b797ad4524471282a6081383471
-
SHA256
ce845b0a702585cfcae3fbd0b2f87e620622f1ecc2d793c1eb663eba7355ae6b
-
SHA512
8a5d6ee287371aebd90d51f0349ee7af25c6402cebf2d155df31fae70b3fad1bc908256cb57cc73a35ef88500b92bc3fc9e0f3a8e7aa225a105d775b3d5d8402
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Suspicious.Win32.Save.a.5480.4695.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Suspicious.Win32.Save.a.5480.4695.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.enerzi.co - Port:
587 - Username:
sales@enerzi.co - Password:
Enerzis@123!#
Targets
-
-
Target
SecuriteInfo.com.Suspicious.Win32.Save.a.5480.4695
-
Size
879KB
-
MD5
365407f16ca457e0c46a0bbfd1333efb
-
SHA1
48d78f7e3f150b797ad4524471282a6081383471
-
SHA256
ce845b0a702585cfcae3fbd0b2f87e620622f1ecc2d793c1eb663eba7355ae6b
-
SHA512
8a5d6ee287371aebd90d51f0349ee7af25c6402cebf2d155df31fae70b3fad1bc908256cb57cc73a35ef88500b92bc3fc9e0f3a8e7aa225a105d775b3d5d8402
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-