General
- Target PO-240320.exe
- Size 455KB
- Sample201109-1hphmhcs76
- SHA256 233d048b25dd9be7683b3c2cf2d7ebe79b92676d4d787c5cd2f59bd8eab1faf2
- MD5 76a9c3ab597f693069d037eac41c6e0b
- SHA1 f08d200fb4bed89322f5579de8cb3fa26f22ee95
- SHA512 0ef08ab59c39b12a2dc8d7f7a998581746bf0cec7fad67406d3a4664a9ce01ffd89aaa427f5d14178a4dec32126b239d54c13cfbaeef128e7698eb1c096e16e9
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
PO-240320.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PO-240320.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
us2.smtp.mailhostbox.com
-
Port
587
-
Username
-
Password
mpjw2013
Extracted
Credentials
-
Protocol
smtp
-
Host
us2.smtp.mailhostbox.com
-
Port
587
-
Username
-
Password
mpjw2013
Targets
-
- Target PO-240320.exe
- Size 455KB
- SHA256 233d048b25dd9be7683b3c2cf2d7ebe79b92676d4d787c5cd2f59bd8eab1faf2
- MD5 76a9c3ab597f693069d037eac41c6e0b
- SHA1 f08d200fb4bed89322f5579de8cb3fa26f22ee95
- SHA512 0ef08ab59c39b12a2dc8d7f7a998581746bf0cec7fad67406d3a4664a9ce01ffd89aaa427f5d14178a4dec32126b239d54c13cfbaeef128e7698eb1c096e16e9
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext