General
-
Target
eda7136fc79a38f5ac3548da536ee932d3b1a5be741965a89c08d25aaffc2f43
-
Size
406KB
-
Sample
220520-3ljbjshbb3
-
MD5
880b205ea09a494b7e075c709d8e4d0d
-
SHA1
38c0fb1da01ee7a99431c1cebe990ee5822f723c
-
SHA256
eda7136fc79a38f5ac3548da536ee932d3b1a5be741965a89c08d25aaffc2f43
-
SHA512
48686eea44fd3bed876585e3918ec9dd3d5d245c3912a9caa6d260957f6ea0a00a01ab301373e228c0e99516422ba167dc33050e4de4dafbc747a0a34409b14e
Static task
static1
Behavioral task
behavioral1
Sample
PO# 3323__20201506.xls.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO# 3323__20201506.xls.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
335410
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
335410
Targets
-
-
Target
PO# 3323__20201506.xls.exe
-
Size
461KB
-
MD5
2928d38ac0a28d2d9e8164a885823c40
-
SHA1
166795207d1f948ea35d9f7927ca8fe0cc8935d0
-
SHA256
4e1d9e3cb83b44c13a9870d21f59b4eb335167d952a6914583a8a0259d6c16c0
-
SHA512
3204ae4bb8213b9434c89b2ddde19c7777597c615fa62d4259f61dbea48795d31a870bcde2a8c19d0da4747b65b886b91fc1849a2ad4a0fcb6956da7a11ac45c
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-