General
-
Target
9960f17788ddeb3efe6a3718a9331e682e628047830d047eec663564eaa829bd
-
Size
359KB
-
Sample
220521-cybt5aeff5
-
MD5
e8268f8210663b625dedf8b8ea33c961
-
SHA1
275f652f48a8a55cf10c819d5d401c5d4e22256f
-
SHA256
9960f17788ddeb3efe6a3718a9331e682e628047830d047eec663564eaa829bd
-
SHA512
927b8d26d4fe5d44a3b0a489cb77a5231a3c047068931556647765229b7b585da3029d984be6d36b643088e33955fa1b2e5f4b6041e6b2f3690cd9f6b9b08e95
Static task
static1
Behavioral task
behavioral1
Sample
Bank Receipt.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Bank Receipt.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.bapipl.com - Port:
587 - Username:
[email protected] - Password:
Bharat123
Targets
-
-
Target
Bank Receipt.exe
-
Size
413KB
-
MD5
bd113a5daa8af5e21075b18dbcdaa675
-
SHA1
1817166dc0110cff751a493a355ecb3272905ad8
-
SHA256
1abdedc05bdc10f0cd2c772c7d13040f239f2c6238b720a4a0138c003fa1fc33
-
SHA512
5504329026ec234636a8fc092a8be794573a5891e2a7b17f255dad1afd8df716675077d89f8d7338963c887c1da4cd0be6f4bdb2f3cd8dbc2011f942d5a58721
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-