General
-
Target
d5ad6660646acadedcdf99ddeb33f4ff12e4f79b0bcb1ed5bc02208a841237e4
-
Size
399KB
-
Sample
220520-3qtcbaccbm
-
MD5
88a8c30e0f0182c11c5e4a6014a499de
-
SHA1
4674de388072fce982a2ca4f017dc92856bd5861
-
SHA256
d5ad6660646acadedcdf99ddeb33f4ff12e4f79b0bcb1ed5bc02208a841237e4
-
SHA512
f7cdbce1d977e0bd00cdc110b5c8da55523f56d3d22e9f1ea1762cde20876c4cdf9493beb9c61878115de4f5e201501f08eb249d8820cde735a7fd1ef67ab464
Static task
static1
Behavioral task
behavioral1
Sample
Sürgős fizetés 008400650189.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Sürgős fizetés 008400650189.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.fratellidelpiano.com/ - Port:
21 - Username:
[email protected] - Password:
playboy123#
Protocol: ftp- Host:
ftp://ftp.fratellidelpiano.com/ - Port:
21 - Username:
[email protected] - Password:
playboy123#
Extracted
Protocol: ftp- Host:
ftp.fratellidelpiano.com - Port:
21 - Username:
[email protected] - Password:
playboy123#
Targets
-
-
Target
Sürgős fizetés 008400650189.exe
-
Size
441KB
-
MD5
4e19c98566275228601a1dbabf4ce261
-
SHA1
625c108838cc5f1004b6448b8dac9db633e2aa5f
-
SHA256
885f9d6937a0f07103509cc5bc1ec2e65550bd8fe56682cf00dac66e62012675
-
SHA512
112e78521eb801f52671d94adde0b604989310472486d200bda5f39f517e08e82fa2afd94785f8b97427992f07cb8f9d78bd63f2d2d674c846a84f13b606c524
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-