General
- Target 50008248-SWIFT Copy, pdf ..exe
- Size 633KB
- Sample211124-rcpleschak
- SHA256 e644c575f18d16b4e432bc02d45c35aff42affc618f7c08e3d9139405e0cea7c
- MD5 8706a44b45140807c8af82c69f192e92
- SHA1 6e1b6f744fd21ed3ea0853c98b49adedf97561fc
- SHA512 84563618abb822283682e9999a93e8dfdfb97206930e1ebdce838895b2f7b0b1e92b5662f33cc4af681828b28c1de6caa3d02dfaf78c8134286fa559efe788a1
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
50008248-SWIFT Copy, pdf ..exe
Resource
win7-en-20211014
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
50008248-SWIFT Copy, pdf ..exe
Resource
win10-en-20211104
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
graceofgod@amen
Targets
-
- Target 50008248-SWIFT Copy, pdf ..exe
- Size 633KB
- SHA256 e644c575f18d16b4e432bc02d45c35aff42affc618f7c08e3d9139405e0cea7c
- MD5 8706a44b45140807c8af82c69f192e92
- SHA1 6e1b6f744fd21ed3ea0853c98b49adedf97561fc
- SHA512 84563618abb822283682e9999a93e8dfdfb97206930e1ebdce838895b2f7b0b1e92b5662f33cc4af681828b28c1de6caa3d02dfaf78c8134286fa559efe788a1
- MD5 SHA1 SHA512
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext