General
- Target 12060.exe
- Size 1.5MB
- Sample201109-7vxmdhnmp2
- SHA256 4738e34731dbb7118b9fa18e46bb4e101664bf0bb54d49899904e8ff0f18dfd1
- MD5 83119e3dc11001e6f06d306a4d5b0ea7
- SHA1 b0c0c333b694bd3e5bf902b48bf34d46121ac6c6
- SHA512 abd86076474966a7ed293d071e825a1a8a6ffea3bfa4a5b21e8ba1bf227e711cc4a4a2da0eaa49001fef2b9c405fbce655a49896d6487a299d2407fb36f6db8f
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
12060.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
12060.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
ftp
-
Host
ftp://ftp.valea-iazurilor.ro/
-
Port
21
-
Username
-
Password
nnamdi99@
Credentials
-
Protocol
ftp
-
Host
ftp://ftp.valea-iazurilor.ro/
-
Port
21
-
Username
-
Password
nnamdi99@
Extracted
Credentials
-
Protocol
ftp
-
Host
ftp.valea-iazurilor.ro
-
Port
21
-
Username
-
Password
nnamdi99@
Targets
-
- Target 12060.exe
- Size 1.5MB
- SHA256 4738e34731dbb7118b9fa18e46bb4e101664bf0bb54d49899904e8ff0f18dfd1
- MD5 83119e3dc11001e6f06d306a4d5b0ea7
- SHA1 b0c0c333b694bd3e5bf902b48bf34d46121ac6c6
- SHA512 abd86076474966a7ed293d071e825a1a8a6ffea3bfa4a5b21e8ba1bf227e711cc4a4a2da0eaa49001fef2b9c405fbce655a49896d6487a299d2407fb36f6db8f
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext