General
- Target Ref 10M-86776)..exe
- Size 706KB
- Sample230418-qndgvsbf49
- SHA256 4c2f9e82e4659646aa281ac883da686b8599b518a536dbd3a2b0cf40620e0860
- MD5 221eb061fe7e6d03e95ba08feb6e7248
- SHA1 cbf7c7cffd7d5b56cb005ae9d9d7b0450e00884a
- SHA512 fa4b114e5ec87631e48138c30a5c63a90e94eb1ed906b6c896dc5db84e3c1de20016a247d75d39e733dc57577db7df34e14921cef5f1b45d259c0b3a811b243d
- SSDEEP 12288:qnzIiJO0BLWwL/Gf6uldEyHAIsKmAvjwSbUbHOw:qntI04Y9ulVpJsSQbJ
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
Ref 10M-86776)..exe
Resource
win7-20230220-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Ref 10M-86776)..exe
Resource
win10v2004-20230220-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.expertsconsultgh.co
-
Port
587
-
Username
-
Password
Oppong.2012
-
Email to
Targets
-
- Target Ref 10M-86776)..exe
- Size 706KB
- SHA256 4c2f9e82e4659646aa281ac883da686b8599b518a536dbd3a2b0cf40620e0860
- MD5 221eb061fe7e6d03e95ba08feb6e7248
- SHA1 cbf7c7cffd7d5b56cb005ae9d9d7b0450e00884a
- SHA512 fa4b114e5ec87631e48138c30a5c63a90e94eb1ed906b6c896dc5db84e3c1de20016a247d75d39e733dc57577db7df34e14921cef5f1b45d259c0b3a811b243d
- SSDEEP 12288:qnzIiJO0BLWwL/Gf6uldEyHAIsKmAvjwSbUbHOw:qntI04Y9ulVpJsSQbJ
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext