General
-
Target
45d5cbb777a70025d8f32cb8de30bc0fd9bd81391bcd2e6b825ef1b18091b812
-
Size
381KB
-
Sample
220521-axla3aahf8
-
MD5
e599f028a60cd463ccf230e60f756d92
-
SHA1
dfdeea4ef92e72a73826738e9fb3a9e9ef869391
-
SHA256
45d5cbb777a70025d8f32cb8de30bc0fd9bd81391bcd2e6b825ef1b18091b812
-
SHA512
6b5fe669dde214fcf6da3d904cdbcb49458bea3f494076f05ae21bcf16b5adef2740beb31b5cde041ea8ba5ab526055502bce8b00b77dfd82fbca5447e67e5b5
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.epaindemgroup.com - Port:
587 - Username:
[email protected] - Password:
}bf9e+EW5s$k
Targets
-
-
Target
Quotation.exe
-
Size
548KB
-
MD5
9cf9dabcd4bc18a2fa81313277e8db8c
-
SHA1
52cc52fc375a70b6c5fe5e44986ba14f0095434f
-
SHA256
d1bd877b6b748426000286d808fd8a397869e91f2e400aa328a290363b57fa0b
-
SHA512
95a17318bc22766f3687553d9275e714ffdfa89c54cab77581ad55a91d186e812b4e0b84228ae43c81e939ed9918484c87bd239c4de78a529cc4e47cae89732a
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-