General
-
Target
fef330d48bed61c5c87bbce7eb9124c4e46b9fa8b5a070ae1f2dd1d061bb16e0
-
Size
465KB
-
Sample
220520-3g6ahsbghm
-
MD5
d05723e63bc0199a3fc8484ce38e082a
-
SHA1
c84813f4222f199c0749d8883d4ba11760f997c7
-
SHA256
fef330d48bed61c5c87bbce7eb9124c4e46b9fa8b5a070ae1f2dd1d061bb16e0
-
SHA512
067700760d9ebe6f51221d298afd21f9cb4e890c7494a575befde6d0f13d5034dbaff563e6a94009b1e2709fa1defc1ea645b4e6eff2cf2d6fb7ee0450bc2677
Static task
static1
Behavioral task
behavioral1
Sample
inquiry.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
inquiry.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
afoerinwa123456789
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
afoerinwa123456789
Targets
-
-
Target
inquiry.exe
-
Size
581KB
-
MD5
9f37c7f11d9c082bf73b0fb2b62f061c
-
SHA1
59e9098505cfb5dd7f5973526801bff99b530d0e
-
SHA256
4b38bf714e41ae836367e3ececa5762c8e03e276eead27d05dee39e5ef298503
-
SHA512
e85384c68047bc85fed331635dca72711ecc0b46d21e6990282b58457ffa3544dc8077bd267e6804ad8cbb0c3d3350379cfcf891cce213da9960e8db4e3b39f9
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-