General
-
Target
e2926fe08147ddefdf1eba31c56e8a08ae51778d99c302ced3b339edcf64e6e4
-
Size
559KB
-
Sample
220520-3na3yshbg5
-
MD5
1ab59e5936f1ffb1fac51cac987efa93
-
SHA1
841570fd7d6b6747828c1ba7e96d37430ca8d808
-
SHA256
e2926fe08147ddefdf1eba31c56e8a08ae51778d99c302ced3b339edcf64e6e4
-
SHA512
5ac4d558531a96d2ecdf8c59d4e8aa9853720142ddf837f9e7b992b87cc434ef30135bf26e74ae5e3594fe1ec12900c7b62f2f7eb6dfa682658d7da8ce07db34
Static task
static1
Behavioral task
behavioral1
Sample
NEW RFQ..exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
NEW RFQ..exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.clrakmheu.com - Port:
587 - Username:
[email protected] - Password:
GDXAP$m2
Targets
-
-
Target
NEW RFQ..exe
-
Size
741KB
-
MD5
079e6eb484455032acf3b2fd4c11299d
-
SHA1
7451b2517d7373f7a81c0876fd66bce472321f79
-
SHA256
b681ce953d7122c634acb0c68e4885a7e6d182acfbc43f886160b2796f452d99
-
SHA512
d55f2e77a5288720d0a7d3ddd0a523cd9e6b9fe4855c19eb909f101349bba799e2207ff5ed01c44453cdd35e31e553092ae5081e05f8a0f8db4f5a490581e1b3
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-