General
-
Target
Remittance_Report.exe
-
Size
543KB
-
Sample
211022-kfahcaccbj
-
MD5
817341449a197b56cdd3795ca7dba89b
-
SHA1
b4f79225b1c45f49771fd72e046d43be1acfab59
-
SHA256
3806b35c08f81f6b6d8e3d9d4e9321ffad60f1edbb969655ed90926832c443d9
-
SHA512
92c1b7ec4686e81b6e27437439f4fbec7bd66d5117ec1f830a0c1bf5da2aa3f1dc8d41b0d8ed539a501c9ea49a513440666a6fc644fad7e9312ebf0b10c92ebd
Static task
static1
Behavioral task
behavioral1
Sample
Remittance_Report.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
Remittance_Report.exe
Resource
win10-en-20210920
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.sautiyapwanifm.com - Port:
587 - Username:
uwada@sautiyapwanifm.com - Password:
Uwada12345
Targets
-
-
Target
Remittance_Report.exe
-
Size
543KB
-
MD5
817341449a197b56cdd3795ca7dba89b
-
SHA1
b4f79225b1c45f49771fd72e046d43be1acfab59
-
SHA256
3806b35c08f81f6b6d8e3d9d4e9321ffad60f1edbb969655ed90926832c443d9
-
SHA512
92c1b7ec4686e81b6e27437439f4fbec7bd66d5117ec1f830a0c1bf5da2aa3f1dc8d41b0d8ed539a501c9ea49a513440666a6fc644fad7e9312ebf0b10c92ebd
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-