General
-
Target
45039a98fc24a27ed3f1542f0ab781206b5dd69ed8378a84f18c380f20554451
-
Size
453KB
-
Sample
220521-axrg3sahg4
-
MD5
d74c0ea5282db3775165967298b51fe2
-
SHA1
e37434077f86afbe8893a90e901ec6578f4f3368
-
SHA256
45039a98fc24a27ed3f1542f0ab781206b5dd69ed8378a84f18c380f20554451
-
SHA512
f75ab86ad57c3db6eca71d8e92248afaee7aed8a551a8fa95e025d49a80f17f5a7f80ae26d05b471ec075586bc1ae9ab25cad8947059fa8537fc7dd6a6214303
Static task
static1
Behavioral task
behavioral1
Sample
IMAGES AND SPECIFICATIONS - RFQ DTD 24-0720PDF.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
IMAGES AND SPECIFICATIONS - RFQ DTD 24-0720PDF.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.anantcreation.co.in - Port:
587 - Username:
[email protected] - Password:
RUC&!^%*29
Targets
-
-
Target
IMAGES AND SPECIFICATIONS - RFQ DTD 24-0720PDF.exe
-
Size
720KB
-
MD5
cb11ecf7241a48ebe88b231b933255b0
-
SHA1
f0bd3c7a22d481f8b63125e004b8af748140356d
-
SHA256
9712dff3b6fa45fc67392d63381d89f975fa09cf553d8ed69bad81cd61b8ff65
-
SHA512
5a974c8590db15d5c6bb84c8fc66e8762c48cfb0d451af0895a6478fbc53bee7b8315956a615356df178f0e7f8311de30f7868f0c2fd5be05459b8f08736a005
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-