General
-
Target
Order.exe
-
Size
550KB
-
Sample
200707-t8b8mehetx
-
MD5
3badfd574a87a4131b77a702be0dd919
-
SHA1
48ca2366912f4d461b71228efac1cdf3fae2b8e3
-
SHA256
973eafd7f0c78c4ba4e0c692881d82feb75679e7704cc4e077c0d48851032c55
-
SHA512
397239b5cd59a37cf540feca76c9938068b7e8db85e26ec7626ec53dd4e0901faaecdbe1eb52d33e21ee8514d8e810338aa92f275b16c3e9d29e66114f5050df
Static task
static1
Behavioral task
behavioral1
Sample
Order.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
Order.exe
Resource
win10
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
111aaa
Targets
-
-
Target
Order.exe
-
Size
550KB
-
MD5
3badfd574a87a4131b77a702be0dd919
-
SHA1
48ca2366912f4d461b71228efac1cdf3fae2b8e3
-
SHA256
973eafd7f0c78c4ba4e0c692881d82feb75679e7704cc4e077c0d48851032c55
-
SHA512
397239b5cd59a37cf540feca76c9938068b7e8db85e26ec7626ec53dd4e0901faaecdbe1eb52d33e21ee8514d8e810338aa92f275b16c3e9d29e66114f5050df
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-