General
-
Target
39961f6845df4e9eb0fa85c8b0bc753075eedf3275944600631ba56afefc2973
-
Size
478KB
-
Sample
220521-azyzyaeael
-
MD5
ab2fbe32ebe4a2f68c9bb019d0119ed6
-
SHA1
c08fc48a374166badf148c5834f74fbf5d2dd9a9
-
SHA256
39961f6845df4e9eb0fa85c8b0bc753075eedf3275944600631ba56afefc2973
-
SHA512
ef443b6e42587c3cf40ca547a76289bf130f9fe5b93c574abee1d5d62c5a0358e74bc61cf828e5a0427070751806e1abfb2882c64cbdecd9a2b1380b0e26e0af
Static task
static1
Behavioral task
behavioral1
Sample
Curriculum Vitae.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Curriculum Vitae.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.pharco--corp.com - Port:
587 - Username:
[email protected] - Password:
tHKfMRa2
Targets
-
-
Target
Curriculum Vitae.exe
-
Size
770KB
-
MD5
5d0b272074dfbb2f95c6fcdd2f4e6571
-
SHA1
6e726792f98a6c27488356ebafa392ecf0f045d3
-
SHA256
5bb841161ff484e03a7cfe4ffe1ec77920ec61ab2e8eafa0c63e15b749ca34cb
-
SHA512
6f33c4024da67af987664a57a37a9fadbd5ea4384aca2044be2892651f21919ab092dfe53cf5535da879efc4804f1a3d961f5d8da7a260c37e30ee8cf66347bb
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-