General
-
Target
4211c5b7b23a49af6dbef099e50c2bd32c7027fe437cbf94e4ed13a5889bff5d
-
Size
1.2MB
-
Sample
220521-aydmlseaar
-
MD5
6e8019e445e885d87fc9521dc977864e
-
SHA1
39e57478d75e1c5711380a8a1241166b70d576dc
-
SHA256
4211c5b7b23a49af6dbef099e50c2bd32c7027fe437cbf94e4ed13a5889bff5d
-
SHA512
1df9381567b35615784a82633c57e168ad5a74c86bff3c5fd21bd519c7f525fc5cd47d39738952d81d572382b513bf9b66429ea1e69062dba399b4bc4ed560c1
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_20_2.scr
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
RFQ_20_2.scr
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
[email protected] - Password:
sparedone
Targets
-
-
Target
RFQ_20_2.SCR
-
Size
481KB
-
MD5
ae7eec82b44c6c1619a156d367f97474
-
SHA1
0315445529f60a5c77136a33c484306f69dde485
-
SHA256
1144219246f22a35049d3c74f60e7e09e1b8a65f24b14b7985fcad58bc9e6cfd
-
SHA512
8e540150fe0bc3c85c84a8953e6797c314dd0595a3c305929268b64af4155ee4575487509fb2b0ad1f4d6b4c4111f795051ff0e43612db1abed9e34db98559fb
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-