General
-
Target
f4ba7e998f08cc08353169560467f5401d4dc868d8876c4fb36982ab92b29250
-
Size
380KB
-
Sample
220520-3kft2ahae9
-
MD5
96ff25f7d41a4855d540d9ffc871a0a5
-
SHA1
d20388941ba9d35d783fb6707817e30570022dd5
-
SHA256
f4ba7e998f08cc08353169560467f5401d4dc868d8876c4fb36982ab92b29250
-
SHA512
963fc3d8276bdc77d24e83cac7c194600daf6e3149b49b96b641e2f67c1e1623c3d01de0012db3a5c24c9015cf46455b6ea21c428b728ef8c08b58241e424d89
Static task
static1
Behavioral task
behavioral1
Sample
?????????? ???????? ????????.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
?????????? ???????? ????????.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.lokalboyz.com - Port:
587 - Username:
[email protected] - Password:
@pLnz*y@W71n
Targets
-
-
Target
?????????? ???????? ????????.exe
-
Size
561KB
-
MD5
e185c970fb0e8f1557f0301f3ed162d3
-
SHA1
e9ae11dd4da0091bec975b7041bfc4d74ea90759
-
SHA256
b84f51a8448ff531ac11939b6ed24a854cb9a72926fce8f5bcf3e07781bf98f6
-
SHA512
5cae4767a0836e91e4b5b34283df2e372756d13ae692405a33ad4866e3a7f695ef832abaa438c3881201b5ff21af4c68909110d6385a36cb0e60f0001a07c745
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-