General
-
Target
fded78379ff7f374d578df5d4c45f67da108ab959b85b4ce206092c86d8ac2a8
-
Size
388KB
-
Sample
220521-b7x82sdda6
-
MD5
f0ec1494791bb61e2e8462bf18d1403d
-
SHA1
b9d9eed3ec4daac30bfaad0546971fa88fe95633
-
SHA256
fded78379ff7f374d578df5d4c45f67da108ab959b85b4ce206092c86d8ac2a8
-
SHA512
b41912c951c53f3fc27a6f05905ad0faa8d11c2e47003ce7f56b8db664daa0a0b84a2f27c30674a68b04254d6c4c3657ed4582752817451a75821610bacfc327
Static task
static1
Behavioral task
behavioral1
Sample
TT- Swift Copy.pdf..exe
Resource
win7-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.hotel71.com.bd - Port:
587 - Username:
chat@hotel71.com.bd - Password:
9+^va&phP1v9
Targets
-
-
Target
TT- Swift Copy.pdf..exe
-
Size
446KB
-
MD5
6bdd9c15243bd5b8709b87b7ba10b3a9
-
SHA1
780f690b92f29296254f00b9f1958c2359991ad2
-
SHA256
2580575e95648d76aed0be387fbe6423ef72639b8aaa9e1ad84ebc5b74bcf7b5
-
SHA512
46a0f1f8a1c6d6cfbea8c287cd9f06fb44e987f8c452a2e5f99da852d871de1552a25eb7d79c794c817e16c7917d3e39383046173699c1fcc07f53dec0ec5cdd
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-