General
-
Target
04a990af9ec733087cd99c0923184bca77cdd9ac0212383bcdeeca36dfa60abf
-
Size
249KB
-
Sample
220520-21yt4sbchk
-
MD5
9c753821e1f320f36d91b03e17a398ea
-
SHA1
dd8138ece680ac297b5b46366a6e49b1affc86df
-
SHA256
04a990af9ec733087cd99c0923184bca77cdd9ac0212383bcdeeca36dfa60abf
-
SHA512
11f58cb140c3aaed7b4c781d7a2919a411ac13ccb271ad20791be2fb6ee45d615d607a4069358830aae34c4e106657ae1aff5caaa6041a83dae7b0c06833b51d
Static task
static1
Behavioral task
behavioral1
Sample
PO INOXIA-2020082.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO INOXIA-2020082.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
alibaba123
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
alibaba123
Targets
-
-
Target
PO INOXIA-2020082.exe
-
Size
424KB
-
MD5
f19e40c4a17e876861224a3bdf4865db
-
SHA1
7c128d123de06af4fdb9448aab02ae952ca0896a
-
SHA256
89783698af3d7850d24aab49842448e97ea61977ceb7133d501057349d8cbffe
-
SHA512
e2912aefb14683aae061fff3db8590622fe7da72c88d05f8b32045090a432b274175ac3a3705e2620888380762249d987bcb73eade2c05c8c42d44f1e8adc083
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-