General
- Target IMG2007.exe
- Size 806KB
- Sample200720-jymaxmrrkn
- SHA256 55d2fe466aeeb92b6f8b45ac8a3961da32e03211f9d006347d946d072cba3848
- MD5 8328f50a0624bcbfb73c4f5e312cb8e1
- SHA1 1f903f1f96004fa83de577fd46a6134bc0b0414a
- SHA512 ab7a7426c5fdfa98b5bbb0c774fb261a7ec668f9ab51fdd2616267b60df1ccbb36f01a08e249b4afeed519fb0101f55a54688b962b22b4f2ed7a016d05cf96f8
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
IMG2007.exe
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
IMG2007.exe
Resource
win10
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.dhruvanford.com
-
Port
587
-
Username
-
Password
agmsales@123
Targets
-
- Target IMG2007.exe
- Size 806KB
- SHA256 55d2fe466aeeb92b6f8b45ac8a3961da32e03211f9d006347d946d072cba3848
- MD5 8328f50a0624bcbfb73c4f5e312cb8e1
- SHA1 1f903f1f96004fa83de577fd46a6134bc0b0414a
- SHA512 ab7a7426c5fdfa98b5bbb0c774fb261a7ec668f9ab51fdd2616267b60df1ccbb36f01a08e249b4afeed519fb0101f55a54688b962b22b4f2ed7a016d05cf96f8
- MD5 SHA1 SHA512
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext