General
- Target DOCUMENTS.exe
- Size 808KB
- Sample230526-qacneaff33
- SHA256 92a02cabe14060c80ea49990e59dd745476c0b5961cd08a07e384db9241fb003
- MD5 278971a2fbcb84316adb4a5eb73424cd
- SHA1 f3111611b12188a9fac01ec3c72a250df985c10f
- SHA512 9534ca6de19e0db714c1f8e61eca74f31b9f69e84601b54ab3fd447d5742e78116b4a0e4b54a04e6d1fbc6e07ca5893eb67e245053ca2d62356713f5b34cf508
- SSDEEP 12288:VH4WviTB2Qwbr9CdovqPNfbcr4pW+kPjLeC37m/9KH:J4WcJxPNf0eSP/eCo9K
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DOCUMENTS.exe
Resource
win7-20230220-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
DOCUMENTS.exe
Resource
win10v2004-20230220-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.garagerobert.be
-
Port
587
-
Username
-
Password
dibi7779
-
Email to
Targets
-
- Target DOCUMENTS.exe
- Size 808KB
- SHA256 92a02cabe14060c80ea49990e59dd745476c0b5961cd08a07e384db9241fb003
- MD5 278971a2fbcb84316adb4a5eb73424cd
- SHA1 f3111611b12188a9fac01ec3c72a250df985c10f
- SHA512 9534ca6de19e0db714c1f8e61eca74f31b9f69e84601b54ab3fd447d5742e78116b4a0e4b54a04e6d1fbc6e07ca5893eb67e245053ca2d62356713f5b34cf508
- SSDEEP 12288:VH4WviTB2Qwbr9CdovqPNfbcr4pW+kPjLeC37m/9KH:J4WcJxPNf0eSP/eCo9K
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext