General
-
Target
7d13ce311fc118285f4da0173fe22b65fe28f88438ac4d8ca4de542ecc0075d5
-
Size
485KB
-
Sample
220521-akchdsada9
-
MD5
078124c95cb63b89b47c7a47f5fd24c3
-
SHA1
0e2f777ceeb949b172cc08b715ec8e5e25e85b13
-
SHA256
7d13ce311fc118285f4da0173fe22b65fe28f88438ac4d8ca4de542ecc0075d5
-
SHA512
b03532cf17904391823099c702a03f6ce66604051d5bda58c990b116af98a57b27491c4765540b924b4089de2d2f5a1260e2b54c0f82bf47c0a0a6a7b6c5bcad
Static task
static1
Behavioral task
behavioral1
Sample
Quote 2.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Quote 2.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.autoshorp.com - Port:
587 - Username:
[email protected] - Password:
VUgvRXU7
Targets
-
-
Target
Quote 2.exe
-
Size
602KB
-
MD5
72fe37dccaaae429b207e041e7b63f47
-
SHA1
f02610d1f9b9b88fe913199da0c94cea0efd6389
-
SHA256
dea162d39606424263d7694403e0d3207dbf1bcc5ad8abaa0efc5cd42f9afcd0
-
SHA512
6d4ab8b31127f48a8ddf1c1a7d77146cf34ca9ffcd4b013c06ae19efc6ee928fc5b33660bcb04a7e4be5acbe30d197ce7e6b98e13fc8078ecf31e184350d471b
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-