General
-
Target
679d9cf4a78a95096a66ea6f375a3ad4624b688c6713faf2661de86c9f4fe58a
-
Size
347KB
-
Sample
220521-n67sbahhem
-
MD5
93dd1a9fe1590fb0e2b3cdb0982bfce3
-
SHA1
5a747beaf4d3cc0b30a6c97efa8779d84142a1f4
-
SHA256
679d9cf4a78a95096a66ea6f375a3ad4624b688c6713faf2661de86c9f4fe58a
-
SHA512
5dd1a6eea547258206665c4d65dfa5339d89af932819987cd90c36b40b54d4a21b1eeb2207e47071f94d2b1a42229bca32cb08d4ea1914af6e33573e15e6adc8
Static task
static1
Behavioral task
behavioral1
Sample
4500021328.docx.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4500021328.docx.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.oaslifting.com - Port:
587 - Username:
[email protected] - Password:
admin2214
Targets
-
-
Target
4500021328.docx.exe
-
Size
421KB
-
MD5
2c3d5716cfcf7a98ed3b30cc75eaa66b
-
SHA1
4da7deb929f9c674bdcc18305b07401308b6a8b2
-
SHA256
7fb38c253c297bdd3fc18c3c3d98e7c3010c15e868eeb395a740f49d6181d20d
-
SHA512
15cb50ff592eea24498058049ed9d8133225488aaec615d245b6d49b896f04413f2399ca45660261c07de72087f3ada4ee411336e989301d9d4d030c29be7c82
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-