General
-
Target
e00d0d70ba75046df18f78fbb2943738b3cb44dfed0a7e11cfd11f16e69bf96d
-
Size
466KB
-
Sample
220521-ny4qpaech5
-
MD5
665a13cd75e65d45969663d463fe45fe
-
SHA1
3ea07dd71e0a6245ef7d03e1f0d219c1eb55831c
-
SHA256
e00d0d70ba75046df18f78fbb2943738b3cb44dfed0a7e11cfd11f16e69bf96d
-
SHA512
f519cb07d720e2b67c06f67d6e389df9721cd0c7f805d8b42d78ecf7627e058fc568d2de0e7793aa6cb0c8272df74575ea0d2d0fce3f80c4d172344822c17ea4
Static task
static1
Behavioral task
behavioral1
Sample
2020.05.8 - 7779 7501 1294.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2020.05.8 - 7779 7501 1294.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.fridec.com - Port:
587 - Username:
montse.varas@fridec.com - Password:
@zOmvs]eL!$*
Extracted
Protocol: smtp- Host:
mail.fridec.com - Port:
587 - Username:
montse.varas@fridec.com - Password:
@zOmvs]eL!$*
Targets
-
-
Target
2020.05.8 - 7779 7501 1294.exe
-
Size
509KB
-
MD5
c3e5e47de044708a5db025ee0ce0a5e0
-
SHA1
267099acf5da2bd39600802e11e8f8987659d5e1
-
SHA256
69fd444f0eb7bb59be2d6c832b345ec4ba7dfbb1195611770339f43cfd4bd19c
-
SHA512
28635b697cb8d8f926418b273c20820c331e1735e719e42d7fec4bd88bdff11fe0cad23ef698ffb1be2a471a3b76c52b03a6e8a0a0cc62684b9bb3bb4335858c
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-