General
-
Target
a7857a8f3d8ae57db9bc6c48aaeb2b2b7f6190b7fbd4cb72d66dd9a7f9f8c91a
-
Size
368KB
-
Sample
220520-2wkfxsgbb5
-
MD5
97a34da4e49f20eab3c17f2bab3d13b6
-
SHA1
6dc384a6bfbcae830c87d538339dfbdfba609685
-
SHA256
a7857a8f3d8ae57db9bc6c48aaeb2b2b7f6190b7fbd4cb72d66dd9a7f9f8c91a
-
SHA512
cc638340ffbba6d8c46cb39756670737f13cd7cf0ec8489c7d8e48566de1275cc346b7e9557d8bdccf71e5a8a2032db38050859436feaf91c8bbcdba4057cc34
Static task
static1
Behavioral task
behavioral1
Sample
a7857a8f3d8ae57db9bc6c48aaeb2b2b7f6190b7fbd4cb72d66dd9a7f9f8c91a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
a7857a8f3d8ae57db9bc6c48aaeb2b2b7f6190b7fbd4cb72d66dd9a7f9f8c91a.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.teracefinancial.net - Port:
587 - Username:
[email protected] - Password:
sG!xcfQ8
Targets
-
-
Target
a7857a8f3d8ae57db9bc6c48aaeb2b2b7f6190b7fbd4cb72d66dd9a7f9f8c91a
-
Size
368KB
-
MD5
97a34da4e49f20eab3c17f2bab3d13b6
-
SHA1
6dc384a6bfbcae830c87d538339dfbdfba609685
-
SHA256
a7857a8f3d8ae57db9bc6c48aaeb2b2b7f6190b7fbd4cb72d66dd9a7f9f8c91a
-
SHA512
cc638340ffbba6d8c46cb39756670737f13cd7cf0ec8489c7d8e48566de1275cc346b7e9557d8bdccf71e5a8a2032db38050859436feaf91c8bbcdba4057cc34
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-