General
- Target PURCHASE ORDER.exe
- Size 1.5MB
- Sample201005-e2drt73c4x
- SHA256 b052d189fbba69117efc6e10e1cada3faee844cb59b5f0d1482734976c72bd58
- MD5 b52112bdfc9dddbdc6fbb9d736f44f5a
- SHA1 2d103b260d9e72844e590dc46b72f33a4e2fe178
- SHA512 99ff1fa69ad9e26cfcf0ce3e96a4bdb56a01b5f22992f75c3a400720944ddd34f4889b812cd7ac4994417a5f39c751c998d4be991d67b6ad2dd569f7874fe782
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER.exe
Resource
win7v200722
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PURCHASE ORDER.exe
Resource
win10v200722
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.goldenamoonresorts.com
-
Port
587
-
Username
-
Password
golden@123
Targets
-
- Target PURCHASE ORDER.exe
- Size 1.5MB
- SHA256 b052d189fbba69117efc6e10e1cada3faee844cb59b5f0d1482734976c72bd58
- MD5 b52112bdfc9dddbdc6fbb9d736f44f5a
- SHA1 2d103b260d9e72844e590dc46b72f33a4e2fe178
- SHA512 99ff1fa69ad9e26cfcf0ce3e96a4bdb56a01b5f22992f75c3a400720944ddd34f4889b812cd7ac4994417a5f39c751c998d4be991d67b6ad2dd569f7874fe782
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext