General
-
Target
11f8436dc996dcbdee4994070df2f730e47dca58bb1ee83a3377b3728f24e921
-
Size
429KB
-
Sample
220521-bca52aegbk
-
MD5
8960c2cc0f66e55b698a81917915c78a
-
SHA1
481769d39fcdbec3f66bfa74a9e762532864bbce
-
SHA256
11f8436dc996dcbdee4994070df2f730e47dca58bb1ee83a3377b3728f24e921
-
SHA512
8d50c7744b65fcddd9891c664e14194bb520f3a8ea5cb704d98d2f02b94c229674fabb555266ed4052c8b7f1fa5a596a1c835df2ae4bdb0cec0964722d88dff6
Static task
static1
Behavioral task
behavioral1
Sample
CTM-Cash Denominations.doc.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
CTM-Cash Denominations.doc.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.desmaindian.com - Port:
587 - Username:
[email protected] - Password:
vU}t$13*orkO
Targets
-
-
Target
CTM-Cash Denominations.doc.exe
-
Size
643KB
-
MD5
c0a105e07006fa3eb26942a40f8b2eab
-
SHA1
2634355758087d4e7074cb93509be79219399d8a
-
SHA256
4cfa54b4b97d2f12a225b24eb37c89312976f77f48cfa5da3ecd8dcf4a21ec90
-
SHA512
8831fb3f87b0b430e254f02908971413223999ccb155c88826a9a238f8b0c58cdf90bb38eddd1af7aa7c76a405e9e008c8a35023fe51b7bf0b0c84d4935a9ef8
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-