General
-
Target
f3f98739cb9406f85241bfadb5eb218c2e5259560b69590fb221e417e672bd44
-
Size
620KB
-
Sample
220521-nzhvlsedb2
-
MD5
4c2f907cb798217169adc31a2ec46e8b
-
SHA1
d20e06db48734d10b4422fe15c6a3c0baf8c17da
-
SHA256
f3f98739cb9406f85241bfadb5eb218c2e5259560b69590fb221e417e672bd44
-
SHA512
52b091b2e29400cd37461c1050d13b6efc4c407f408e1605c642ba6378e1d0084ba8d5f3a31dd234c676b9021ae62dca7a5d5057c884259ec1b8d48e2409ce75
Static task
static1
Behavioral task
behavioral1
Sample
Quote N6A802020.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Quote N6A802020.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
leonardo.doro@yandex.com - Password:
bigboy5570@@@@
Extracted
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
leonardo.doro@yandex.com - Password:
bigboy5570@@@@
Targets
-
-
Target
Quote N6A802020.exe
-
Size
1.1MB
-
MD5
28ff301f93a2280e59ec786e935d9664
-
SHA1
43ebd776da25d1b9fe39a917f9a2baeb313aebdd
-
SHA256
e1963450d039de80c01fe2f1f984f87f02ea10f83ccbf4ed53c27d92c8050070
-
SHA512
c467ed845a3875f3d34059bd8fd36e608dc6b35fb51f1433a372f6234dcd7ccfaf23d0a08bec9b5d83ebb03ff7137beb75e55743eefcbf4aeaf3c0ed27ea36c4
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-