General
-
Target
ad83f4a4.exe
-
Size
1.1MB
-
Sample
211023-j7j1escbg9
-
MD5
c91f24fcf484e59d3ab03e707144459a
-
SHA1
9b21351158fc241ecc52a51beca027c1162694d6
-
SHA256
ad83f4a4563b94420182654f956f45c6555d88c4fb0392dbe73df0eeafbdfc17
-
SHA512
14cae63fa00235b8300e3fbf9dd71ba45692e5de692e2ab418f647a43de81de6272491b31ad7af5d4e5ad9236749c800e3eb83971d77491047eda428b0a000b7
Static task
static1
Behavioral task
behavioral1
Sample
ad83f4a4.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
ad83f4a4.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
sales@xxltrucck.com - Password:
zxcvbnm12345
Targets
-
-
Target
ad83f4a4.exe
-
Size
1.1MB
-
MD5
c91f24fcf484e59d3ab03e707144459a
-
SHA1
9b21351158fc241ecc52a51beca027c1162694d6
-
SHA256
ad83f4a4563b94420182654f956f45c6555d88c4fb0392dbe73df0eeafbdfc17
-
SHA512
14cae63fa00235b8300e3fbf9dd71ba45692e5de692e2ab418f647a43de81de6272491b31ad7af5d4e5ad9236749c800e3eb83971d77491047eda428b0a000b7
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-