General
-
Target
c2ed8b9d8a198f0c85dc8d21edd8b74594f351244fae6245f8a3fb5bbd646505
-
Size
416KB
-
Sample
220521-ng3gasghbm
-
MD5
b039dc831436d3cbff5da72383909af2
-
SHA1
5224a8abf8fcc1dfffbd36ae3a9f49348bb4633a
-
SHA256
c2ed8b9d8a198f0c85dc8d21edd8b74594f351244fae6245f8a3fb5bbd646505
-
SHA512
830e21a9bdbc56e5a8200c4c8a0640e125cd8ecaeb65e9df1f8407d9fcf6a7c949d80033fe7567f6f0ee7d2e91a5938aac75743b46b4039265dd9635395c8e14
Static task
static1
Behavioral task
behavioral1
Sample
FINANCIAL YEAR CLOSURE MEMO.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
FINANCIAL YEAR CLOSURE MEMO.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
petersonhouston@yandex.com - Password:
faith12AB
Targets
-
-
Target
FINANCIAL YEAR CLOSURE MEMO.exe
-
Size
464KB
-
MD5
1af40f34ed02b3d6b367d1c5470ee874
-
SHA1
9b879b6a4bd2ab1bcdbcf37847f7c429ed9a2f0c
-
SHA256
918c237103937dc88a6e0124cecdd9b1e7f5ac7baf4aa9f087d664e77a963185
-
SHA512
7e1dd748055f4402b7187cee7edb6d43d0756b38bece678705bd8ee5a915e8ee40d166be6ad4c755631d3ef975a6a480ba3d432cc9fb34dfecb5a124cb677b9b
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-