General
-
Target
87207224d2b312019683ddffdcd5a0eb66f6177c2a18290987b9efac661f01e5
-
Size
432KB
-
Sample
220521-br2arsfdel
-
MD5
0257024e439ad20770205c6019f7238b
-
SHA1
acd9c818e30c055e10387dda3f1c16fecc2d5324
-
SHA256
87207224d2b312019683ddffdcd5a0eb66f6177c2a18290987b9efac661f01e5
-
SHA512
bcd1aa5faa30ee5a877f7d9c7b6ce122a7a175cb38398481f5a2171bf859c773b0ee11cf49590f3bfd3ac9aa17705df159fa654110739b7e57baac0091d335c1
Static task
static1
Behavioral task
behavioral1
Sample
bank details.tar.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
bank details.tar.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.pptoursperu.com - Port:
587 - Username:
[email protected] - Password:
mailppt2019-
Targets
-
-
Target
bank details.tar.exe
-
Size
503KB
-
MD5
561978ce5c5027ddd74ab9958c89569e
-
SHA1
dbf352dd70a714e9f1f0b03832c0eca8eab17754
-
SHA256
34604c450edccb519e89347afd87707ca455038abfc2cc0e5b2919a4a677f93c
-
SHA512
b262294b164202685a9a6cf4b829bc2e2db820a254315bc1386e080c3617212673300d93a076ccef1d28c5e2ff5769c2d46eb1296a731e7edfaaaad0f6f14ca3
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-