General
-
Target
8d6a92e17adef3ed21deb04451410e715a260374f2bf7b67facd125f95d344e0
-
Size
548KB
-
Sample
220521-n16m3aedg8
-
MD5
73945834dc5f8e4566a3975acfe9c1fc
-
SHA1
5eb4310933da24652d8db4857ac13aa881d47f53
-
SHA256
8d6a92e17adef3ed21deb04451410e715a260374f2bf7b67facd125f95d344e0
-
SHA512
bf99e37a4ad37947238aaa23b339cb505c6fa196375ccb163b212a0c05146af2e230d6e7d2f89dab14c67c1a5ebf5185cacf6990b26f61de11842ccaac17b523
Static task
static1
Behavioral task
behavioral1
Sample
scan copy SOA MAY 20 pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
scan copy SOA MAY 20 pdf.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.mail.com - Port:
587 - Username:
[email protected] - Password:
Godisgood1
Extracted
Protocol: smtp- Host:
smtp.mail.com - Port:
587 - Username:
[email protected] - Password:
Godisgood1
Targets
-
-
Target
scan copy SOA MAY 20 pdf.exe
-
Size
926KB
-
MD5
f078e913c06dc1a55ede520b3ed9304d
-
SHA1
a61988bea6c7f614d284ecfddae059eaf55aa219
-
SHA256
2d418c09f973adbf9bb140ae1d43ea8b37db0131cb1dc0ee1086a2219ce002a2
-
SHA512
edd7199d3c5187e99ce243b86b8cca397511f4a13952954b5969feec2323c7535977acb0b35cb2dd6cbcdb8c1ad239b546232d2005bb440312a731d9cb57ef7b
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-