General
-
Target
c4759541d76b82d14c45ac3db5d24d774a8ec1a7264cfd698f145c037bb99979
-
Size
347KB
-
Sample
220521-nz9y4aedd6
-
MD5
12315fb385f130161373f221c4da08e3
-
SHA1
df3d48939f032ff12d4e9a5929963e26f730df6c
-
SHA256
c4759541d76b82d14c45ac3db5d24d774a8ec1a7264cfd698f145c037bb99979
-
SHA512
f48e487004b57a6ae86a619dc97e32ff89d77453b27aaeccd3170b71fec283e203a6bd77d54656298680e4cae95f3579af4ac111f30f813d6c9fe45087af7cbd
Static task
static1
Behavioral task
behavioral1
Sample
signed invoice.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
signed invoice.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
chimez1@mosaiclayouts.com - Password:
1xH}wgu7}f%E
Extracted
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
chimez1@mosaiclayouts.com - Password:
1xH}wgu7}f%E
Targets
-
-
Target
signed invoice.exe
-
Size
402KB
-
MD5
6cccf06531cde6e874578efcc012fee9
-
SHA1
67097ee4eba670c009f6076f88fedf1f6614e77f
-
SHA256
96352448182bfa2343d852728db64321c0c0ac16077786cdd1210cfe3856d695
-
SHA512
c502778291dd528a5c6070e976b5eae21c87fc47c2efc7e056b41e15c0e1b1b6da7a78055a37023685dee66dda07ec5b321724a735250cb62b4c5036a0e5b4bd
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-