General
-
Target
3f33ad806e3b9edcd5414df483fa31a91395c983c35714277f7bf8ca74db2a7e
-
Size
634KB
-
Sample
220521-ayx19abad4
-
MD5
e901076ed0de6a7feadaa7cab298ba32
-
SHA1
5287650f74ac4b50eadbf6db38a7ad3617376e83
-
SHA256
3f33ad806e3b9edcd5414df483fa31a91395c983c35714277f7bf8ca74db2a7e
-
SHA512
5e1b3d9340b808e8b3db50891b4985df96fd610b04c9d4345d432da50b218c5e945636589763f6dccd25d205775079e395b9d1842be41a4c762a88522512faa5
Static task
static1
Behavioral task
behavioral1
Sample
Product specification.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Product specification.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
107.152.35.241 - Port:
587 - Username:
[email protected] - Password:
speech
Targets
-
-
Target
Product specification.exe
-
Size
879KB
-
MD5
3d81936d4f07a119b37f9d3a45012d47
-
SHA1
34587306cce993af14eceb7d8a88c41a26b08ac2
-
SHA256
0538015f91c94d63edf194e7be7ec2e4ca956e479d50c1d0963e5a0238ab5f30
-
SHA512
1ecb8f7d06552891a8f5c6da4cf5fda13183b964f779118d1b179b7646fb0021d6c18c7b415f6302f0136f9e026b0011854d333acdfe526ce58bc14101e0c20e
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-