General
-
Target
ed9698fe15f126c3f0a7cbb91f79b6e32d2227837d406be234614ecfcaa4d6db
-
Size
546KB
-
Sample
220521-bzy6dacgc9
-
MD5
5d43c66eaf006fecc14e079e342f9f1e
-
SHA1
f0e7fa616baaacf2029a8c2526d3fd757ff6ff98
-
SHA256
ed9698fe15f126c3f0a7cbb91f79b6e32d2227837d406be234614ecfcaa4d6db
-
SHA512
fc9dfa764048039a6b93fcaf4095206d589120a08eb6b97f59d74dc297e735a845f1ff89502c47201c219c99df0a2cae9e18a9ebc818aa34251fec623b1f7e40
Static task
static1
Behavioral task
behavioral1
Sample
Payment Confirmation Scanned.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Payment Confirmation Scanned.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
!c}w0m3nCK#h
Targets
-
-
Target
Payment Confirmation Scanned.exe
-
Size
485KB
-
MD5
53c9db3975c364b1f3964244c1e4688c
-
SHA1
57d57cc154e0f658e71ce3e5c32790b758869911
-
SHA256
0cd0ad019a38165ffc42a6700bc0bdb3e00b06280e56e0ab01df6f074ee5f625
-
SHA512
d375fdd6c3f92d81c992dcc219fb25f406892e5b4ac449bae7e712a6b8a2fb1c2247ef65afb7f65767cf52714e42095645e7dd4a6203caac3bc1d403c03a77a4
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-