General
- Target PO-SER-PL-M17220.exe
- Size 556KB
- Sample200818-st28ahaykx
- SHA256 e3e667f5f3f179990bcb4616c8e5d56eeb8399bd867799c4bc68fac82c9b0a0f
- MD5 4d6faa4b74340610fd2ae29186cb9ed0
- SHA1 50b0b424988b02f51598365273f47c8b43c4def4
- SHA512 32d69c917045ab7a700c8a31c9d326f1910885a6da36bcef8f458265518a78f465c45f4192c734bb6887159ffb5e4a9f3bcc11f93f10f29df8117925f0b3f03c
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
PO-SER-PL-M17220.exe
Resource
win7v200722
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PO-SER-PL-M17220.exe
Resource
win10v200722
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
vicanto1994
Targets
-
- Target PO-SER-PL-M17220.exe
- Size 556KB
- SHA256 e3e667f5f3f179990bcb4616c8e5d56eeb8399bd867799c4bc68fac82c9b0a0f
- MD5 4d6faa4b74340610fd2ae29186cb9ed0
- SHA1 50b0b424988b02f51598365273f47c8b43c4def4
- SHA512 32d69c917045ab7a700c8a31c9d326f1910885a6da36bcef8f458265518a78f465c45f4192c734bb6887159ffb5e4a9f3bcc11f93f10f29df8117925f0b3f03c
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext