General
- Target 5X40ft Containers.exe
- Size 438KB
- Sample200624-hmvnbvmhes
- SHA256 9d988ed519f6e3f6c1e9baec5fca64bbc07fbcbb09f8dd6a02d4b756d1f4ef6e
- MD5 1af135fb8f6ae323f00e79fdffa28614
- SHA1 3fda3bab855977ec61f8c8a9fc8b2afebfbbfe5f
- SHA512 4e8c6fc8aeba956d3b80717a56490fbfe311927b6d0ab3d37269fa42f7406aea1f9ecd014f4d8a0188bf0c9e4d1b22d64d3ed3280190ade061bb70ee55bebf92
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
5X40ft Containers.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5X40ft Containers.exe
Resource
win10v200430
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.privateemail.com
-
Port
587
-
Username
-
Password
coronavirus2020
Targets
-
- Target 5X40ft Containers.exe
- Size 438KB
- SHA256 9d988ed519f6e3f6c1e9baec5fca64bbc07fbcbb09f8dd6a02d4b756d1f4ef6e
- MD5 1af135fb8f6ae323f00e79fdffa28614
- SHA1 3fda3bab855977ec61f8c8a9fc8b2afebfbbfe5f
- SHA512 4e8c6fc8aeba956d3b80717a56490fbfe311927b6d0ab3d37269fa42f7406aea1f9ecd014f4d8a0188bf0c9e4d1b22d64d3ed3280190ade061bb70ee55bebf92
- MD5 SHA1 SHA512
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext