General
-
Target
BANK NAME.exe
-
Size
663KB
-
Sample
221125-fy9ypsgg9v
-
MD5
3cbd0f4d5317fbe2027c49c21c4f7b24
-
SHA1
567601b9520f05e4dec7559212af1fd863e328a0
-
SHA256
ecfe7056494cbc6dc0d572e3d2a7ead974f20cf5ad98bd237ad2d81a36f07cb7
-
SHA512
b1cb18e5b72c4e383eaf49bf35ac941c27e072e5b5bb47f982c9b076afe2cbc5791b0f11e4b4be071196cd7ed44914bcb09e892d06641fd340d63651a2ef31bc
-
SSDEEP
12288:jWI3IvM3zrbETCl+BkGtahovqRz0oJi3ihsSbymQJOzKChpHskFgFwIyXCDL:qIYU376Cb4ahsqdHi3ihsSbmsWChxsk
Static task
static1
Behavioral task
behavioral1
Sample
BANK NAME.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
BANK NAME.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.elec-qatar.com - Port:
587 - Username:
[email protected] - Password:
MHabrar2019@# - Email To:
[email protected]
Targets
-
-
Target
BANK NAME.exe
-
Size
663KB
-
MD5
3cbd0f4d5317fbe2027c49c21c4f7b24
-
SHA1
567601b9520f05e4dec7559212af1fd863e328a0
-
SHA256
ecfe7056494cbc6dc0d572e3d2a7ead974f20cf5ad98bd237ad2d81a36f07cb7
-
SHA512
b1cb18e5b72c4e383eaf49bf35ac941c27e072e5b5bb47f982c9b076afe2cbc5791b0f11e4b4be071196cd7ed44914bcb09e892d06641fd340d63651a2ef31bc
-
SSDEEP
12288:jWI3IvM3zrbETCl+BkGtahovqRz0oJi3ihsSbymQJOzKChpHskFgFwIyXCDL:qIYU376Cb4ahsqdHi3ihsSbmsWChxsk
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-