General
-
Target
Curriculum Vitae.exe
-
Size
680KB
-
Sample
211022-klfasabdb9
-
MD5
042270e4d654c314f574b266ed7b6e5d
-
SHA1
1db2f1b45bcd832da784cdf62fcb213311d1dcf6
-
SHA256
395014f2f2875fcd5bd4782263aaa7555f440797de528f5135a1d4c52fc920cd
-
SHA512
faa10d22d214d7a4c9e8a32a04db1f2d1ea71a09ef1ad6bb266f349b452fe93d3f3a9de4d15498574916c82456f8ea62a5e624f4ec428d81c0f0f39333f45fd5
Static task
static1
Behavioral task
behavioral1
Sample
Curriculum Vitae.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
Curriculum Vitae.exe
Resource
win10-en-20210920
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.ofilsysterns.com - Port:
587 - Username:
logs2@ofilsysterns.com - Password:
@o^M)K*1
Targets
-
-
Target
Curriculum Vitae.exe
-
Size
680KB
-
MD5
042270e4d654c314f574b266ed7b6e5d
-
SHA1
1db2f1b45bcd832da784cdf62fcb213311d1dcf6
-
SHA256
395014f2f2875fcd5bd4782263aaa7555f440797de528f5135a1d4c52fc920cd
-
SHA512
faa10d22d214d7a4c9e8a32a04db1f2d1ea71a09ef1ad6bb266f349b452fe93d3f3a9de4d15498574916c82456f8ea62a5e624f4ec428d81c0f0f39333f45fd5
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-