General
-
Target
e441fb72d808b10356c773a2229a64d26af0b7bf76bce3fc575e01d73eadf4b7
-
Size
320KB
-
Sample
220521-xkgtfabhf3
-
MD5
4ca72cdf95f603248189bee49f9291d5
-
SHA1
5743ae6c2f3bda1b139db68109ba0a146c908763
-
SHA256
e441fb72d808b10356c773a2229a64d26af0b7bf76bce3fc575e01d73eadf4b7
-
SHA512
a567c844c58f675284565bed7ed726b803b0ab5756d25b3477331fa31cbea4fe192f2e48dcffc43d99d6e3710e5bf93b4e810b220ef5e0c68677b8b291944e23
Static task
static1
Behavioral task
behavioral1
Sample
RFQ..exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
RFQ..exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
Igboamaka1
Targets
-
-
Target
RFQ..exe
-
Size
363KB
-
MD5
976be92376c72a2c0c4927d2f0a13651
-
SHA1
c6b4a69ebd63382be533a9e2e4dc7c51e5c852d1
-
SHA256
d7bd54e41dbe29893e23fef937a9579c238abaf34196fb8905c3313192ed2393
-
SHA512
eb8bfcb357648cebf8116b744b064dfa05de0c97f8d5a38d24150a21792ef5e7de3d24133af97346fb66b4f58be423d21e5e868a7de8eafe14f345be3de3fd42
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-