General
-
Target
a09613362f58a255e49e80043abff5668c7eae8291511caf5d2258ea1fcfaa6f
-
Size
383KB
-
Sample
220521-pt73zsgac5
-
MD5
5843cbe32db929b9d29e05fe436638e6
-
SHA1
af77faf816c436f0535ec8eb394738cd6eb8b4ef
-
SHA256
a09613362f58a255e49e80043abff5668c7eae8291511caf5d2258ea1fcfaa6f
-
SHA512
f677aeb9d12fbd29f9de7ad7fdefe8e0b3804f6bc28b90fd73b19996f0bc5a5f9a3c7671c5a7a394c20935e715f9366fdbb85486afa41758b6367f7931bca0c7
Static task
static1
Behavioral task
behavioral1
Sample
2USD SWIFT _SCAN TT 190617_2019-NLCIV000003576_ES146009_30309679.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2USD SWIFT _SCAN TT 190617_2019-NLCIV000003576_ES146009_30309679.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.connectus-trade.net/ - Port:
21 - Username:
one@connectus-trade.net - Password:
o^Z0CIU?^yL2
Protocol: ftp- Host:
ftp://ftp.connectus-trade.net/ - Port:
21 - Username:
one@connectus-trade.net - Password:
o^Z0CIU?^yL2
Targets
-
-
Target
2USD SWIFT _SCAN TT 190617_2019-NLCIV000003576_ES146009_30309679.exe
-
Size
430KB
-
MD5
b27c6b07807d2d53886556180ee8fcb9
-
SHA1
81811f0df48b01c76fc2e0586c531b1c93197a47
-
SHA256
c986ea8fc6725c76da91dff92d8ba6f8910c3cd54a7457f73839530aa8aaf002
-
SHA512
f2f76e69929b83ed876ef060fbee607759e09b94741412afb5bf38189775c0b24e3f78f0218fe4d939612f3f256438f4813f70b7841a788925f3cb6c690a32a5
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-