General
-
Target
f506bed39ef88d088f9b0646c8ff357be10c59ea326f9ce7b9c031b9d0a5a254
-
Size
1.4MB
-
Sample
220520-3kddxahae7
-
MD5
81f362d5214097da678a764b4076bdf2
-
SHA1
95eb523cc2c7b54e9d68dfaab8a05aeabd052886
-
SHA256
f506bed39ef88d088f9b0646c8ff357be10c59ea326f9ce7b9c031b9d0a5a254
-
SHA512
ac3a4ad9ad118d849b6fc0137587de4cac3a507838d2531af27933a73653ff9b8f1e55c853330a24fc60ee4213908cdcecd696d42940c1f2b23f935c20426b7f
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_LM29.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
RFQ_LM29.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.kimberleygroupbd.com - Port:
587 - Username:
[email protected] - Password:
QDx{5M]}9]-J
Targets
-
-
Target
RFQ_LM29.EXE
-
Size
836KB
-
MD5
1307faf78a3b2cf812c7603072e07975
-
SHA1
07c5d4a08734c70bca57665570df00f8205f6b98
-
SHA256
58ab939bd2ec0d5d90a58a3be754b4a5a745fb0263b7f211f5f199bca4b4ba22
-
SHA512
33957e9795ae6de9baf137231147882b697c5e9affeec8c96676408c8bdc686fa4837f58aa652fee9323c50810dead0d6ee28c586aa048edcc611db2903e35d8
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-