General
-
Target
e5c123f0392b8bedc87c6ffd1c45f8042a686f76e16d777fac5c0390f975d96d
-
Size
696KB
-
Sample
220521-nywp3sech2
-
MD5
746b91af81dc0d8db2c392366372b5fc
-
SHA1
af79f91a7f22faa5691a3256925da5be645ed46f
-
SHA256
e5c123f0392b8bedc87c6ffd1c45f8042a686f76e16d777fac5c0390f975d96d
-
SHA512
2b963de6f5bf34283d93a17dca920c58cf67d9384fc545fdbdd6dc1f081a847349a1002f951f221e508d3d45e0a09b827387f5b3356526ea2fcf56ca6204bc39
Static task
static1
Behavioral task
behavioral1
Sample
e5c123f0392b8bedc87c6ffd1c45f8042a686f76e16d777fac5c0390f975d96d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
e5c123f0392b8bedc87c6ffd1c45f8042a686f76e16d777fac5c0390f975d96d.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
matt.cashy@yandex.com - Password:
handofgod123
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
matt.cashy@yandex.com - Password:
handofgod123
Targets
-
-
Target
e5c123f0392b8bedc87c6ffd1c45f8042a686f76e16d777fac5c0390f975d96d
-
Size
696KB
-
MD5
746b91af81dc0d8db2c392366372b5fc
-
SHA1
af79f91a7f22faa5691a3256925da5be645ed46f
-
SHA256
e5c123f0392b8bedc87c6ffd1c45f8042a686f76e16d777fac5c0390f975d96d
-
SHA512
2b963de6f5bf34283d93a17dca920c58cf67d9384fc545fdbdd6dc1f081a847349a1002f951f221e508d3d45e0a09b827387f5b3356526ea2fcf56ca6204bc39
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-