General
-
Target
bc7fb8c5a3470b7960d703724c63f52516fa8c80087f35ef9ab2fa24fd23f0b8
-
Size
602KB
-
Sample
220520-3w66cshfd8
-
MD5
d0c4f29e92c177408082d77b02dc16a4
-
SHA1
6f4fbf97d9a9e7b1563e362361779c4c58ee4461
-
SHA256
bc7fb8c5a3470b7960d703724c63f52516fa8c80087f35ef9ab2fa24fd23f0b8
-
SHA512
571ec22568efb271596764677c6a1f03134a109c2a38e3a91d41669d766ca67992c4d4afdce088b04ecffe1e45a6bfae35a8244b68a11e292e969d8671a43274
Static task
static1
Behavioral task
behavioral1
Sample
4642WOT-T7864-66OBO.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4642WOT-T7864-66OBO.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.ionos.es - Port:
587 - Username:
[email protected] - Password:
08140480968Ju@
Extracted
Protocol: smtp- Host:
smtp.ionos.es - Port:
587 - Username:
[email protected] - Password:
08140480968Ju@
Targets
-
-
Target
4642WOT-T7864-66OBO.exe
-
Size
849KB
-
MD5
101062008fb9ba3acbb9b4191a9441ce
-
SHA1
6e3583b4c0f54bff4bd7ab157b60f53d195d8399
-
SHA256
ddd4cacc7365872cd4b9d06f4a2de4f131191dae071ed5430ed0399014f1aac2
-
SHA512
6653eb98f1987272b64dfaf07eb132002911a6b400c3a5a84e754fa997ca78b325d5e847e6a2a4a97fdce505d42c14f483dfdb55dbcb901074b6fa20135168bb
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-