General
-
Target
2e976c521487e839c57ea0f4458e191369ed4eab27b32d1de8c3369401766a5e
-
Size
264KB
-
Sample
220521-n99q3sabak
-
MD5
84dea33900237cb2955e28a78653c1ba
-
SHA1
126f873a52deff889afbd0cb51c1e1e6ad5abf1f
-
SHA256
2e976c521487e839c57ea0f4458e191369ed4eab27b32d1de8c3369401766a5e
-
SHA512
4c420e7e012068e28c588610e137cacca0c7e60f1b70f6a9501d0ac3a50dbb1c64c724671a2f51733c34f5694982792711909f8e2bca6b02aac6bda1092f6036
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT INSTRUCTIONS COPY.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PAYMENT INSTRUCTIONS COPY.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.pcandles.sa - Port:
587 - Username:
sales@pcandles.sa - Password:
almadi@123
Targets
-
-
Target
PAYMENT INSTRUCTIONS COPY.exe
-
Size
374KB
-
MD5
d6d939bd2a1263100823ea0374986d5b
-
SHA1
47ac7811435eae2d9640befee318520c9df3f3bb
-
SHA256
9398978502aef97b52b10321c7a0d177a4f16d1dc260ad29e8d7cd099b2c8dcb
-
SHA512
710ca536a6cb94a2086129d79123a25c077a4be9ea89fac6da2e3ea942fd1a2aa4b0931df894da4b64b6129922fedc8bf832fea7b097d6f25a9119cc8a312bbd
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops startup file
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-