General
-
Target
6cdb0014cb76656eb8751f603c6bcd7c225705e5bf18f365ec83f4bd5472d02b
-
Size
1.2MB
-
Sample
220521-nhb1qsghcm
-
MD5
7945c5266f83da164fc9f88a5f4d4ac1
-
SHA1
6d28c985c4ad754c492af4ef864c865c360c6d17
-
SHA256
6cdb0014cb76656eb8751f603c6bcd7c225705e5bf18f365ec83f4bd5472d02b
-
SHA512
45ae4916a9ebfc14d19dc1c35d9665c45ff31c06936825444f087d4c9d2664d3a0c0b60986bd345cb6fa686ba1960bf5f96dd005e698e4799843839b96c4baa5
Static task
static1
Behavioral task
behavioral1
Sample
PO_SUTEX.scr
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO_SUTEX.scr
Resource
win10v2004-20220414-en
Malware Config
Extracted
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
ultimate.love@yandex.ru - Password:
Blessed000@
Targets
-
-
Target
PO_SUTEX.SCR
-
Size
515KB
-
MD5
158409a8e0b10d6cb4aafe93187988d6
-
SHA1
9f903e503c73e761ca14a2f0a428ed653a735c03
-
SHA256
e754344a3911deba8d4242e3ee3817cdd5fe69f846ed2c915140ec5d9050a2e8
-
SHA512
1d09de0c9c5ff8245a02253933b7e420bd1b13fd9ff7f278cdb9af00d5b4867408db0b56894788e401cfc6ffb1d2ad1d73333c182a9c0e5b9b8899531b033f95
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-