General
-
Target
b76db9b5dd76ceb0dc9ce6c697ca4083a1ddb2d618b661a27c21748c422fe56f
-
Size
546KB
-
Sample
220521-ptf99sgaa7
-
MD5
30cceb11385dccf47158fb942e5c71dc
-
SHA1
3cb87422cd66bfe80a4ae9bf54498160728d9c1c
-
SHA256
b76db9b5dd76ceb0dc9ce6c697ca4083a1ddb2d618b661a27c21748c422fe56f
-
SHA512
6f81e34a1e243f46c67fb6ec7d23b8441402e4f984aad14d5d6068c4aebc3dccd4097eac6b938870b4ce26a633e31d86f318283edbb9b53ba82a673efa5e62ea
Static task
static1
Behavioral task
behavioral1
Sample
Remittance Copy.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Remittance Copy.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
daily@is-ceo.com - Password:
63075OFF!
Extracted
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
daily@is-ceo.com - Password:
63075OFF!
Targets
-
-
Target
Remittance Copy.pif
-
Size
789KB
-
MD5
c9c5b92936bc5eba4ef381d0d815bef3
-
SHA1
6be466bd73ca5be4bdebbf059e799db20f105211
-
SHA256
656e99ec9ba18c70b338604ef390ce523a35339c8bc556ff2963ca2ce87baec7
-
SHA512
0fccc574106ff99ec695e61e74502003c30e296ae9ad4904e30c27f45e5435c67fc8ea20059f74db0282fb8d243468bf4b5f6e9c6d66b39f5a89453f422ae258
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-