General
-
Target
4501307788.jpg
-
Size
551KB
-
Sample
200710-fdtdwp1y2s
-
MD5
525ffc51861aa3e034a920675a3e0103
-
SHA1
5b9342b3934769dee07c5e1a56525aeea917e508
-
SHA256
aa47e9580c4ae0012ca77f96f5755ac49129566b7c9331b6d3749e96707f440c
-
SHA512
2643190ba8e5652e7e4b8a513ce93724bc54abdc195f5b537c9c9b3d3f82b883fc2f270d091ea05cda904505dedad415355f526c287705980f53f53edb3c9a6c
Static task
static1
Behavioral task
behavioral1
Sample
4501307788.jpg.exe
Resource
win7
Behavioral task
behavioral2
Sample
4501307788.jpg.exe
Resource
win10v200430
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
HYF76io83%$6
Targets
-
-
Target
4501307788.jpg
-
Size
551KB
-
MD5
525ffc51861aa3e034a920675a3e0103
-
SHA1
5b9342b3934769dee07c5e1a56525aeea917e508
-
SHA256
aa47e9580c4ae0012ca77f96f5755ac49129566b7c9331b6d3749e96707f440c
-
SHA512
2643190ba8e5652e7e4b8a513ce93724bc54abdc195f5b537c9c9b3d3f82b883fc2f270d091ea05cda904505dedad415355f526c287705980f53f53edb3c9a6c
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops startup file
-
Suspicious use of SetThreadContext
-