General
-
Target
3a4acc44.exe
-
Size
877KB
-
Sample
211023-jqdgbadbcp
-
MD5
7d0449b813d5e482283d9af021fe1f97
-
SHA1
a9132296eeb71feb5a1cb5f4003873720e387ace
-
SHA256
3a4acc44cfecb679c5cc9dab88989065b2735dca8f669efaee948fd01a38f748
-
SHA512
adaf288bffe86ad4b871d4a8f2a592bb96a6249b98f777b66ecbe3aceff91c9cb358b594287d785162d8cb511e3450e08e2e84365d90658de44cf8992d8e70a6
Static task
static1
Behavioral task
behavioral1
Sample
3a4acc44.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
3a4acc44.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
foodbiotechnology@meetingsemail.com - Password:
terrin2233
Targets
-
-
Target
3a4acc44.exe
-
Size
877KB
-
MD5
7d0449b813d5e482283d9af021fe1f97
-
SHA1
a9132296eeb71feb5a1cb5f4003873720e387ace
-
SHA256
3a4acc44cfecb679c5cc9dab88989065b2735dca8f669efaee948fd01a38f748
-
SHA512
adaf288bffe86ad4b871d4a8f2a592bb96a6249b98f777b66ecbe3aceff91c9cb358b594287d785162d8cb511e3450e08e2e84365d90658de44cf8992d8e70a6
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-