General
-
Target
8d7e7de33c7e1f4d0f3bc0ac20f92e2f2e0df9ee62b93a3e340cdfdbbf6a27c1
-
Size
407KB
-
Sample
220521-ndcfpsgfbm
-
MD5
74969b24c9ebbc12c8a23b74fa7e22f7
-
SHA1
b079f31fd517e0633a15e7cb4541445f5f7a62ac
-
SHA256
8d7e7de33c7e1f4d0f3bc0ac20f92e2f2e0df9ee62b93a3e340cdfdbbf6a27c1
-
SHA512
483741f9e543239d896af7c54669737b69091fb5a993087066eeb6317aaefb0b4d04f4b2632a179141b46e18be7e8e1cecf26b51ed5bd87500ffb7cd81e3eb3d
Static task
static1
Behavioral task
behavioral1
Sample
NEW RFQ_Dole Int'l Korea.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
NEW RFQ_Dole Int'l Korea.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.flsrnidth.com - Port:
587 - Username:
subbarayan.sathiyaraj@flsrnidth.com - Password:
x{Op,7(4O+yl
Targets
-
-
Target
NEW RFQ_Dole Int'l Korea.exe
-
Size
473KB
-
MD5
25ab12854daf3e994ddfeea8d0770f3f
-
SHA1
47d48a204146fba4efce4b2ef901fc06b2deddc4
-
SHA256
407dbe5863d155a141aec5b500637d794275bf0680e2c8ca34e99f56a28f11a9
-
SHA512
5a625db7252587797f346451da0d3596f6fa6ff6f620b495c8011a48a59a89e9f88fef43c2d52e33f17f9f1838eecfac39f3fae04325bd60ddbec8b12fdb4dfa
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-