General
-
Target
6e956f278d99bc1e9ccb0e947c4a01f1b385e182bad1c0a824f66d4273088c40
-
Size
363KB
-
Sample
220521-nxjzwshdbq
-
MD5
9baef68a860c8e96d8a2a2a71e11cbee
-
SHA1
c4c63a5d0e33597063dda1a1261a9e8a6fa2b746
-
SHA256
6e956f278d99bc1e9ccb0e947c4a01f1b385e182bad1c0a824f66d4273088c40
-
SHA512
9cfc16387fcf2ce20dad1171d305fd9b6c12e7363c11f7e63073473e15c2c411dfab3a0c307b9c6fdd4bb3b40c44e47b742c604a63e4787a5442d8ddaffb12a4
Static task
static1
Behavioral task
behavioral1
Sample
QUOTE 002242020.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
QUOTE 002242020.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.standard-engg.com - Port:
587 - Username:
info@standard-engg.com - Password:
Standard123#@!
Targets
-
-
Target
QUOTE 002242020.exe
-
Size
443KB
-
MD5
d7ad39b060b5353c18aca84d326c55e0
-
SHA1
724ababbaca7fc5b87fc57fcfa9261a06cc4bb54
-
SHA256
79a5a1012a618aa8aeb77bc2742c11120634b0c5ad7bacdf37ee79aff484a6e4
-
SHA512
1396a48ba6d1e715fc699b366d38e6e5a356c6bbd9ceca1779f245594848baca8f7b6f25304509b1ea8614ff9c09d5b06af16b526845bceaeb741b22600cc947
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-