General
-
Target
1383b5452e464d8b1b11bb0a28d8f5fec8e08d620d66dcfbdf71dea18d9a8865
-
Size
381KB
-
Sample
220521-nfwmcsggep
-
MD5
4013684b694bae3b72871b869379327f
-
SHA1
ac86cb322be12527e7e73c1bab49ca58d8642921
-
SHA256
1383b5452e464d8b1b11bb0a28d8f5fec8e08d620d66dcfbdf71dea18d9a8865
-
SHA512
fd3751b1d0a2a2e85a0ff2cccb0e1a5677faed49d013362bbca034e202af9ae661cbf616b8e7713c3820519b1f87ccb98ff2bc53d9689efce7c2b01ed3792af6
Static task
static1
Behavioral task
behavioral1
Sample
RFQ REF R2100131410.pdf (2).exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
RFQ REF R2100131410.pdf (2).exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
sOeKk#E6
Targets
-
-
Target
RFQ REF R2100131410.pdf (2).exe
-
Size
422KB
-
MD5
0253fc675a74d862a070e969154d0cd6
-
SHA1
2834d4fcdca82a4835adf006810705a386ec8915
-
SHA256
7f3d3f1008ceebb52921ebf9519ae7f84f9015ee4f7dcda28cedd5271737967f
-
SHA512
11969a01f965b68a1346f01adbb509342ec2d9744253f7614823d75e4063ec26cd16257caf328f9b1ef6b5ea4eab885e5d39584861f693f6ee6f8c023a0e2129
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-