General
-
Target
bee324db8d9a75f757361aa1b684802ccbfe17b0f98a81d9ab394542d70545d6
-
Size
546KB
-
Sample
220521-ps4n6sbbfq
-
MD5
d67be7ac02cd0e98246a3db5f3cc0ef5
-
SHA1
96c4f90363162f2264be724bf53fb91d4be45a4e
-
SHA256
bee324db8d9a75f757361aa1b684802ccbfe17b0f98a81d9ab394542d70545d6
-
SHA512
6503e806579c87aac4a8a9e9aa2bb1ea9464c5ccf9956e6cd3c7c438599b5dd3cb6d78a9d1c77ca75b438d6fad00d21cfef7b6ce6fa75b54999609e30abab9c8
Static task
static1
Behavioral task
behavioral1
Sample
payment slip ..exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
payment slip ..exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
kingmoney12345
Extracted
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
kingmoney12345
Targets
-
-
Target
payment slip ..exe
-
Size
580KB
-
MD5
9b47246feeea57e036332ce0a59fe316
-
SHA1
6ff968f1287b499926518605d1d4e3405a5d577e
-
SHA256
40f62edaaf245e669c4c4de028657d8762862124d810e9f71184e0dc5ca23df2
-
SHA512
ab95804b3f67590a4edb3a926a8832a3036e48092ca01c3b7def4e2111b481ea6257240dbc08ef5cb4bc84650a784f3a2f09ac66f5033dd5d4ed400d9be10e44
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-