General
-
Target
b50a1054a14e532de0997750bed1fc15999dd836d5faa2603e22e6187493864f
-
Size
1001KB
-
Sample
220521-mnajesfbhj
-
MD5
4a295aa09b6eac8143fe9000fe329d8c
-
SHA1
559c32c7c9322e5595fa9d5a957927b6b12fbcdc
-
SHA256
b50a1054a14e532de0997750bed1fc15999dd836d5faa2603e22e6187493864f
-
SHA512
08c3a8cd80ddce997034bf32d067824b1753f04fb4485e0e8a73f29cbbdceca27e6a8b5b52e89780337ae6671ee12e53f10e36f9a6f9563366e18f9f81e443a2
Static task
static1
Behavioral task
behavioral1
Sample
SKM_C258200233645836648763843,pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SKM_C258200233645836648763843,pdf.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.brightpackaging.in - Port:
587 - Username:
[email protected] - Password:
accounts744
Targets
-
-
Target
SKM_C258200233645836648763843,pdf.exe
-
Size
1.4MB
-
MD5
8b40e480d150fa630b0b6dde49620ca1
-
SHA1
a40340df5ee52b2091cd4d60134a481224f5e6ff
-
SHA256
1a6ced8369156b97bcdafc4b48c1c57ff252bbb4faf077dc29abe9d60ae7fffb
-
SHA512
9ad8adfa334ebf9c1d5737d420cb4d4f3368efb97edb4a44b4f1729536c0b5e001085301e97894e22d4e6d9f7937b6d69026849433e62eeb07d2c3aee7b104fb
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-