General
-
Target
4b5305fa25809bc68b5acb4cf1cbf84f11fcece004c0a9487a17958629a89e7e
-
Size
387KB
-
Sample
220521-bbganabfc8
-
MD5
c387773fe84fb1d8e5540d14eb8cecc6
-
SHA1
fdc492e9f7b84b0a07d5fc89ccd9c35cf35289b3
-
SHA256
4b5305fa25809bc68b5acb4cf1cbf84f11fcece004c0a9487a17958629a89e7e
-
SHA512
a0b80ad854174155236b8ad054d81cfc8a5fd105448500a4f8506396b9084d098f9bba28fbb669bf5df264c199a4af7a00abfa94956506c5be40a7064c8e9375
Static task
static1
Behavioral task
behavioral1
Sample
Quotation list 202006070089_doc.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Quotation list 202006070089_doc.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.anding-tw.com - Port:
587 - Username:
[email protected] - Password:
7#Sjsj*ebT+2
Targets
-
-
Target
Quotation list 202006070089_doc.exe
-
Size
438KB
-
MD5
51484024d193248a18ea77fba933144e
-
SHA1
cd47b6136ccb2a4905cda151ce4ae88b3d0648a9
-
SHA256
8aad38614627972f2d27adc9e0a998ba52c55700c37e70da79f9240ed8b3605d
-
SHA512
bd7ec7520fda27af1ec644678eebdd1c2a7eb6be24bf11c4a2f6ae5914076e4ea78f0ed37f85ffb4dca2ca4602e7c7757f7410c6bb653416fd5512f1de4b6bd1
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-