General
-
Target
PTA009483.exe
-
Size
534KB
-
Sample
211202-rrwy2shfhj
-
MD5
c32dc27c35f471c71e237b07cffc263d
-
SHA1
b8518918c8aeaaaf989e6361907debff3da0d6f6
-
SHA256
ae4bc61fdbd79efa881919084a9858bc02935ae6ed8644f246ff0f56d87d6e9f
-
SHA512
d8f4dde39c62d66a9cfa05728efa151e0d2342bd2ff4b94a85a156a8bed0420459592a22b2409fe2f42557cc3e70c4b5356f14e50df41fe81eabf689e589d11b
Static task
static1
Behavioral task
behavioral1
Sample
PTA009483.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
PTA009483.exe
Resource
win10-en-20211104
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.devmetsan.com.tr - Port:
587 - Username:
info@devmetsan.com.tr - Password:
Murat2019*
Targets
-
-
Target
PTA009483.exe
-
Size
534KB
-
MD5
c32dc27c35f471c71e237b07cffc263d
-
SHA1
b8518918c8aeaaaf989e6361907debff3da0d6f6
-
SHA256
ae4bc61fdbd79efa881919084a9858bc02935ae6ed8644f246ff0f56d87d6e9f
-
SHA512
d8f4dde39c62d66a9cfa05728efa151e0d2342bd2ff4b94a85a156a8bed0420459592a22b2409fe2f42557cc3e70c4b5356f14e50df41fe81eabf689e589d11b
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-