General
-
Target
37b7a1334c08f1cb8f2730c13986c1f24a29716ec227bd471b6a93a28a08daf1
-
Size
678KB
-
Sample
220521-a1empaeagp
-
MD5
70a93a5a734f2d248200f9e6268ea58f
-
SHA1
695584da475f25e16461cfe48d1d92cc119585af
-
SHA256
37b7a1334c08f1cb8f2730c13986c1f24a29716ec227bd471b6a93a28a08daf1
-
SHA512
2d26ca5a8cb3d1864bcb81a5a4769cb91dc0ed2caafa8ae6de109c05729e4f6ed32fa0abd6b5eaadee58dbc338542958e856eb17364bc879b7390a85f2712ce8
Static task
static1
Behavioral task
behavioral1
Sample
Company Visit _Po Requirement.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Company Visit _Po Requirement.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.lebchrom.com - Port:
587 - Username:
[email protected] - Password:
7A3Wj{yq_*ex
Targets
-
-
Target
Company Visit _Po Requirement.exe
-
Size
810KB
-
MD5
ce064009dd1da22fc208669e09ffed8d
-
SHA1
d8fd4f8d3705479755bd04004aec1ba6907007bb
-
SHA256
566d75da52a7a8452233464bc0e22b5ee7242ccdc71cc8e518b76621eebe269f
-
SHA512
ee580a9dc7c872febab8e970439975168cc7b7422398ec266768c5e89a9215e2e7bd835d0ae3c0f6208d18e64a40bdc23e3876b0215abf7b8aaf0da2799215bd
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-