General
-
Target
78898b77d867171a039564c021713f63b1e4b12137fb15eb4cd4e97c20a3d42e
-
Size
447KB
-
Sample
220521-alpt4sade6
-
MD5
fc612a71c08e81e4abf45e11aa87ab65
-
SHA1
3e1b38dee7705ec230d07ecd4b9191775c8dd751
-
SHA256
78898b77d867171a039564c021713f63b1e4b12137fb15eb4cd4e97c20a3d42e
-
SHA512
f10c5e35464a373a8ecf4e0e83e9945402019e191727f92f197ffa6a2b88a215ee350a9f3adefa522a11345797cb23fd2ac660a0f96b16a12320b104e5708522
Static task
static1
Behavioral task
behavioral1
Sample
swift advice Ref[GLV501756103].exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
swift advice Ref[GLV501756103].exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
IZmBVEm3
Targets
-
-
Target
swift advice Ref[GLV501756103].exe
-
Size
499KB
-
MD5
3c29248e3d6885fdbc7918485def416b
-
SHA1
d519b85de73a25025bc3fe0b89178a320feb38f8
-
SHA256
74f0abd5013240cc7c7907544e081c7331c278356e5a0d7a9f5add4105734611
-
SHA512
2ddf3ad3e75d9cd114e60eb0e7ca681f71d2b4a4e841d9c4446c0488b0b5d5e23dfd6ef285d25768890f1cde1cac0383c4c09b17d657aa113013c1bd79b80cbe
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-