General
- Target SUPPLY_ORDER_PDF.exe
- Size 1.1MB
- Sample200804-52m9m2hrya
- SHA256 f9d5e2e9d03bc3fd2673a504c6b89db660543684d24e4cc1ba3b2f1f5fad3f71
- MD5 73cbd8ee499954d83df110a3e04ad754
- SHA1 2d47c7599367fcecc1b6015fb4e88c7295d4a09d
- SHA512 17458df2cd5d14f709bb1133db40b9ecfb5729f4a7c8fef2e32605a586fa3564c81fd0123c88d5f3540807f144b886b3b5ff6764258559f3a3faed5d24567d20
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
SUPPLY_ORDER_PDF.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SUPPLY_ORDER_PDF.exe
Resource
win10v200722
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.brighttextiles.com
-
Port
587
-
Username
-
Password
rabiammi
Targets
-
- Target SUPPLY_ORDER_PDF.exe
- Size 1.1MB
- SHA256 f9d5e2e9d03bc3fd2673a504c6b89db660543684d24e4cc1ba3b2f1f5fad3f71
- MD5 73cbd8ee499954d83df110a3e04ad754
- SHA1 2d47c7599367fcecc1b6015fb4e88c7295d4a09d
- SHA512 17458df2cd5d14f709bb1133db40b9ecfb5729f4a7c8fef2e32605a586fa3564c81fd0123c88d5f3540807f144b886b3b5ff6764258559f3a3faed5d24567d20
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext