General
-
Target
70042e3adbad3d996ae9e79b14c295dd0b0001ac54c9be9698ad750da692d7f6
-
Size
542KB
-
Sample
220521-myyn1acfh5
-
MD5
2d7cc8e02cc8f09234e9a17147025a30
-
SHA1
3741003ed9783cd6d69cc3f3777e12e80be5e7d1
-
SHA256
70042e3adbad3d996ae9e79b14c295dd0b0001ac54c9be9698ad750da692d7f6
-
SHA512
0b863dfe5eb81fdff9ac6fa12e3b925577d63d2af543cd9bc5d000686e77a2c71098daada63cd10ae2104e6c012118ac9133ad9a9a12b57fe42375a4a7d3228c
Static task
static1
Behavioral task
behavioral1
Sample
Proforma Invoice.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Proforma Invoice.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.shyuanhzimeng.com - Port:
587 - Username:
[email protected] - Password:
I$uEADXU7
Targets
-
-
Target
Proforma Invoice.exe
-
Size
923KB
-
MD5
2b952a9344d926a08dfd69de423528e2
-
SHA1
823670d855617a727ae9d9aa0858e49c558bcf41
-
SHA256
ae451bf0f958bf82ce70a55e5e0af6fbb70f1b06cd0bacb5bdc196c16f6da11b
-
SHA512
e9783f69df250cbee29aba8ef09bdbf0de4a6ca1f181b1505bd772aec43753b828befc46e717f6654a0010de93dbe9623abc3027746e8b383e2cb02712159236
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops startup file
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-