General
-
Target
2f7321b2142ae6e691b6ec36e3547fc1a286ccda0074c15c5d30f1ce3b004026
-
Size
1.2MB
-
Sample
220521-b2evhscha5
-
MD5
e341db392bc55252d0298e4bafe6c396
-
SHA1
97367cd0f641c77a7aefe3b54936be4886027519
-
SHA256
2f7321b2142ae6e691b6ec36e3547fc1a286ccda0074c15c5d30f1ce3b004026
-
SHA512
4fce76d18d02014b0808a890a77f2e728c77bb522511e1f11f9c9000bde75badb2b77f06cc7488f794b30ad7654cc6fac6de5c69279ec210c5abd7428e362808
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT_.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PAYMENT_.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.jpme.org.in - Port:
587 - Username:
[email protected] - Password:
Ehimembano1@
Targets
-
-
Target
PAYMENT_.EXE
-
Size
642KB
-
MD5
6623e9cdcd39acf7be13a24b494cac26
-
SHA1
b288fe6377643df99ccc35b2d896b0b219d46a3e
-
SHA256
2dee48503995eb6a1fc38e807bea655d420c181e9b832ca5d52676c8cd527394
-
SHA512
89386a70d4a0877db1a1c1d50d6eb582f4469ba8d06ac8ebc5ed8292223fb10c5a79883135d9f22e70c996383fa1b3fd0cef2deb4645435f36bdca1297301502
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-