General
-
Target
6c01fbc126e374722c264c58abd57e029cf04274d3f239ca59b6b8dc014c55d6
-
Size
292KB
-
Sample
220521-nr75jahbfj
-
MD5
876a92ffdcb6cab2f8693181b5c85df6
-
SHA1
631f9277dff249791aad6d0458989cd62e1b5433
-
SHA256
6c01fbc126e374722c264c58abd57e029cf04274d3f239ca59b6b8dc014c55d6
-
SHA512
031008ddcf70412d6d9265bfcb0a327e7490e96ea323d876e56fdfe9cf15ae58c1e879e9b24fdb9eaaa7e89f85d0302d6d29e28df495699366e743536dab806a
Static task
static1
Behavioral task
behavioral1
Sample
Products description.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Products description.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
alibaba123
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
alibaba123
Targets
-
-
Target
Products description.exe
-
Size
598KB
-
MD5
62df3974ab561482298cfa714ea69814
-
SHA1
4b860c8f44c042b186696f90d16d13c18b1ada82
-
SHA256
44ce0aee858d173dd0575154562f83765798c772f2d22781a107713619d77da5
-
SHA512
97d9e0f077acca676c72d685ec1618ffce675a6719b1942052b1e7e9363940626ade72fbea990c4d5fb5ae94d46a6ef1f80e064072e6bbc9fcc2167cce62fd2f
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-