General
-
Target
c1d1dcb1bcb714040d51b15fd28743bb1ef4d2e0b760b9d00525978a6f8b7be6
-
Size
341KB
-
Sample
220521-bjt7gsfaal
-
MD5
dcd02ffefdbd498768139316e79c5e2c
-
SHA1
79c5d29ff08293b3d29f053e62ba0c5ba1a219f1
-
SHA256
c1d1dcb1bcb714040d51b15fd28743bb1ef4d2e0b760b9d00525978a6f8b7be6
-
SHA512
a500abb1277e4e89f589abd9a92e9d58510a0e767cd719ff76c968b598b51ccdece57fcf3b330ed74bc775f917b8dd8cb4200795cebfa54cc5f465fcc8b9a765
Static task
static1
Behavioral task
behavioral1
Sample
doc.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
doc.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
citechco.net - Port:
587 - Username:
[email protected] - Password:
4wyAOzx72d
Targets
-
-
Target
doc.exe
-
Size
411KB
-
MD5
11c5664cf908411b3d90136a6b83e15e
-
SHA1
54ac300dcc10e40621efff4190801ae7e874e75e
-
SHA256
a1677d2a253abf1984ba62f4d5984aaffa3c1fc9c056aafd7938df620281913b
-
SHA512
863da1cdcddd3f2a2e2b4d631458f155c5725c51452d9c49fc993c8af72432261e370a9c2962d4f05ce926c2123c5c24a70722c1e25a2228ed19140a89798544
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-