General
-
Target
a0ff17fef4cbd797e25277903412a84767d32825150ce7d0532bffa7e29da360
-
Size
499KB
-
Sample
220521-abhm2scgeq
-
MD5
b6343b2be0e75bae31a2d2ecfd947d5c
-
SHA1
30a2b50e521e50535fcf9a3834c943ca9e0ea4c0
-
SHA256
a0ff17fef4cbd797e25277903412a84767d32825150ce7d0532bffa7e29da360
-
SHA512
823555cf3bf28f187182f6bf8061a211301d05ba8d9b1185bbb5cbd1785ffc2920c255340d9d3dad47496722144f4e0ca48cd6db03af1bb29f34240e4feb1263
Static task
static1
Behavioral task
behavioral1
Sample
BOQ&DRAWINGS.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
BOQ&DRAWINGS.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
challenge12345@
Targets
-
-
Target
BOQ&DRAWINGS.exe
-
Size
615KB
-
MD5
3d7a3fa39186bf0e862f58e310354371
-
SHA1
ffea4648d60e2ca8be79dde8c215bc7b8696c367
-
SHA256
f25e092b4b4f92a5fffd42fc6b8e35817037c125a6e1a855b4921419fe89a3d3
-
SHA512
0ca77e7d8c878c644a6a1a5a4cb2b2854bfc0d4a5cb6e97d01ae7fe757ad89e366a6aa3ee958f6d7103017c25164db26159480394fdc7b21ca202d890f05a07d
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-