General
-
Target
7047b9a2b50a8fb360b3d2b53d647582e6b4e93d92b7e266327a01c2f4c4bdf1
-
Size
1.2MB
-
Sample
220520-2x86nsgbh2
-
MD5
3032fca3ba79c136c249f1f4a1cdd74d
-
SHA1
d5e992224f93ab32caed9a54b7e5770073e1b2fe
-
SHA256
7047b9a2b50a8fb360b3d2b53d647582e6b4e93d92b7e266327a01c2f4c4bdf1
-
SHA512
1183a0e18f43a07d996b3d779b4d9f4fd76fb468601f8d591b9fe9e5007c609ffb1004393f8d1eadde8c04d2fe670e35c0ad4bb4574b561b7bac4b6d16a902fa
Static task
static1
Behavioral task
behavioral1
Sample
signed-contract.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
signed-contract.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
9NJSzWzvhDYcb6b
Targets
-
-
Target
signed-contract.exe
-
Size
653KB
-
MD5
074ca5239f5111224c69bedcc6326cbb
-
SHA1
af87db11be8d347179e705ada666bbb3ac294087
-
SHA256
bc96a7521bd576710b531a2b2dd6d7f4b4a0854f6ef8285ec83e0515d27ff299
-
SHA512
6cea88864bd5451a104308821ad8560141afcdd93615aa270bcdf8412cbd0a4088b550101795f40976077ff7f520d74c169282b1c4c5277e687e12a534bc8f0c
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-