General
-
Target
9332e7dfd9292309df5a69941ce7dff1f962fd598daa081bdf0c63d9efcf7873
-
Size
2.6MB
-
Sample
220521-mjrxxafacl
-
MD5
482bd6e9d796294e2617551d1c3cab50
-
SHA1
805b3eb7b6101c139cb986239a1f83f342f2f480
-
SHA256
9332e7dfd9292309df5a69941ce7dff1f962fd598daa081bdf0c63d9efcf7873
-
SHA512
cc6d53551f77a560bf533d09f18f353452d66674a9327518a9f4541e0d253da7b10be08e3553da116c414824ee0ad2b9707a93c0a0ea808884e8bea7e1cc1c2c
Static task
static1
Behavioral task
behavioral1
Sample
FILE NEW.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
FILE NEW.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
kaka1234@1@1
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
kaka1234@1@1
Targets
-
-
Target
FILE NEW.exe
-
Size
3.0MB
-
MD5
b102cbc0f032e59c0de3cd7edaf7a570
-
SHA1
1b89fb414a7d39238f766936cd3f693a778c1a4b
-
SHA256
d802316396757a4c76bee4fc2e01694a6483c748d8db36c15973ef6171d8038e
-
SHA512
6116184ba607f257e0722801f06b4ca7070e99a78f8dfd7cc8c784838c1eb6d20823cf76ec7b7dc9235e75ed65c569eb55aab0e4d295b2ea0e0285c043d58592
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-