General
-
Target
24db22b40b01af7bab207d09b7cd430a5892d646ed6291e416643e546d86ced4
-
Size
410KB
-
Sample
220521-bb2atsbff3
-
MD5
20a058d7813d4247191dd5c80a53043b
-
SHA1
ebc05e1fb6d6c192bc5c61272c2ce375501c22cc
-
SHA256
24db22b40b01af7bab207d09b7cd430a5892d646ed6291e416643e546d86ced4
-
SHA512
e079ff75a4dd8d344e1a089961d5f7dbb08dbda5d32bd88f04cad9da5b537e061e5aa9a8587bd2583456b2666bc9229b6dd78e4715e7117dec54aaad8dd23863
Static task
static1
Behavioral task
behavioral1
Sample
MV Christos Theo.doc.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
MV Christos Theo.doc.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.desmaindian.com - Port:
587 - Username:
[email protected] - Password:
vU}t$13*orkO
Targets
-
-
Target
MV Christos Theo.doc.exe
-
Size
609KB
-
MD5
5083d040d295c0c2ced9dc9178f45b47
-
SHA1
edd06606b96206ff82845786ee298c3a05cc8a4f
-
SHA256
c50ba6556752607323e0e14d5429961d9af3804d9b45f8c7755ec1709efc6af3
-
SHA512
efdc814bad5379526914c51ec17d3acfc37eca1cf47545c7fe8d589a44a1ecd426d97638570d03bdcedb8351d8fe7cb3e5f2faa87aeeb7a6332db6af3318331b
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-