General
-
Target
4592f8ac4b3539ad7d45f196825220f76aa8be34708ba1384d554d3e700691cf
-
Size
481KB
-
Sample
220521-axm5naahf9
-
MD5
ab4db76262c9bb0a1216ea637285368a
-
SHA1
89b0e32f69be92c7eddf28b8fa6802ff7114ec14
-
SHA256
4592f8ac4b3539ad7d45f196825220f76aa8be34708ba1384d554d3e700691cf
-
SHA512
6a32892ff8766d725a36449a02ae36af19ce53e76a8d5ef8b2195d35c8fa0d960fcd562edd11df55a52de1ef18d1a525cd5b8b4a42bda3fd07356884e9f4fcc1
Static task
static1
Behavioral task
behavioral1
Sample
Universal290720.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Universal290720.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.transfastc.com - Port:
587 - Username:
[email protected] - Password:
Godalone147
Targets
-
-
Target
Universal290720.exe
-
Size
600KB
-
MD5
00f60a589041dafd4151990ae2370d1b
-
SHA1
8a5b12491fbab28caa2d19b2b9652c2cc2acab6c
-
SHA256
55c46eca6b7b3d44afd9f09eab01429f08447da65ac74995dbc0a15793824614
-
SHA512
85bc62a41904ac3a3e6336da563c35e1565d0dad4707ffa24cdc32ac77c33f134a5504b96e41587f7c5b6414fe9d67cba36b76e577539db1364718a6fc5940f3
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-