General
- Target FF&E Items.exe
- Size 445KB
- Sample201109-2csnfv1w5s
- SHA256 022f4a9ca3c54c35f75e7ef96cd08b629dbbb2baf4eb5663dc41ee5076fed818
- MD5 38b3cb708739d9919af4b73af4469b75
- SHA1 e71af229bd4d1b8ff821e5428adde7e8e34a3eb7
- SHA512 fc0ca390be52f0c643c60866885c1619a673f90108e31105fa9d19944f3b88c68b7643ce73891cfe48a85de76123f74eac42e6400d5cd817510607e040de0129
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
FF&E Items.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
FF&E Items.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.ociii.net
-
Port
587
-
Username
-
Password
yearofblockmoney5024
Targets
-
- Target FF&E Items.exe
- Size 445KB
- SHA256 022f4a9ca3c54c35f75e7ef96cd08b629dbbb2baf4eb5663dc41ee5076fed818
- MD5 38b3cb708739d9919af4b73af4469b75
- SHA1 e71af229bd4d1b8ff821e5428adde7e8e34a3eb7
- SHA512 fc0ca390be52f0c643c60866885c1619a673f90108e31105fa9d19944f3b88c68b7643ce73891cfe48a85de76123f74eac42e6400d5cd817510607e040de0129
- MD5 SHA1 SHA512
Score10/10AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
AgentTesla Payload
Suspicious use of SetThreadContext