General
-
Target
db0472f382a087a5c418209037bb62531f87288f5b7bcd7db3c744fa71db406c
-
Size
498KB
-
Sample
220520-3pvhzshcf2
-
MD5
dac2f5bfd6234671e13771eabfd57850
-
SHA1
ca89ec61b8180a0732ea722c10fe04dcaf6b319a
-
SHA256
db0472f382a087a5c418209037bb62531f87288f5b7bcd7db3c744fa71db406c
-
SHA512
8a5de45a91eb5966f8aa7be036e649915f1ddbb746631b6e7e9009cf052b98f4cb2b77a5545ea09d9ec18030ae070c41ae74ade305d561533b710244a8e1d467
Static task
static1
Behavioral task
behavioral1
Sample
CguzyjoH6w0Mrok.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
CguzyjoH6w0Mrok.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.sardaplywood.com - Port:
587 - Username:
[email protected] - Password:
sup123st45
Extracted
Protocol: smtp- Host:
mail.sardaplywood.com - Port:
587 - Username:
[email protected] - Password:
sup123st45
Targets
-
-
Target
CguzyjoH6w0Mrok.exe
-
Size
754KB
-
MD5
40394958aa221147f84c6e34cb0ead06
-
SHA1
97e519838586dab48bedcbee7d693edafa5f567b
-
SHA256
5d921fee6553573489b8c72f1afd5f9ffd1c184b182994a6209b36b558923d61
-
SHA512
fbe8ed62b77d053f946c569c7498640f33025d0aa8c7ea674a8e09d1ce239dde47b918f23a66128cba7713b8fd18a219f9bcda476582fce1adf82d248382667f
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-