General
-
Target
384b03372b0048e1cb96f7db323d31af
-
Size
537KB
-
Sample
211022-k6q8sabdf2
-
MD5
384b03372b0048e1cb96f7db323d31af
-
SHA1
26c2955b326420fc61f64fb1f0c1ac26bb8fe6d9
-
SHA256
21cd1dea5f6846f81699ddc9c7a4469901a87c13efd253001c030645bcca9fd3
-
SHA512
f5be075a925c363ebd0a2174ed587637d76f60401ae2d45bdd0210ae989b817df4f702529bbd289bfc1c5b79efeaac4597f838c7ac0ca62cacf7a15f5cff5f73
Static task
static1
Behavioral task
behavioral1
Sample
384b03372b0048e1cb96f7db323d31af.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
384b03372b0048e1cb96f7db323d31af.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.tccinfaes.com - Port:
587 - Username:
margaridasantos@tccinfaes.com - Password:
TccBps1427log
Targets
-
-
Target
384b03372b0048e1cb96f7db323d31af
-
Size
537KB
-
MD5
384b03372b0048e1cb96f7db323d31af
-
SHA1
26c2955b326420fc61f64fb1f0c1ac26bb8fe6d9
-
SHA256
21cd1dea5f6846f81699ddc9c7a4469901a87c13efd253001c030645bcca9fd3
-
SHA512
f5be075a925c363ebd0a2174ed587637d76f60401ae2d45bdd0210ae989b817df4f702529bbd289bfc1c5b79efeaac4597f838c7ac0ca62cacf7a15f5cff5f73
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-