General
- Target Delivery Note - AWD 200837363738-3383736363.exe
- Size 1.5MB
- Sample201109-94ghbsc8m2
- SHA256 27a269f6ae5d574c36867a138c2edb49c8bc680453f97f2dc497d8f166bbba37
- MD5 80dfd8475203bc4c4c8b19925619689d
- SHA1 56de10e20deb363f56e4600bbbfbe3c63e40bc7b
- SHA512 e1ae0497ec1e6798c6675d2d2bbb76197f6b609cafc8416f6d1117867edea70b29dd757678930e3c3d57752d198485401b1becb349426ba30d809956c04243bd
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Delivery Note - AWD 200837363738-3383736363.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Delivery Note - AWD 200837363738-3383736363.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
ftp
-
Host
ftp://66.45.232.205/
-
Port
21
-
Username
-
Password
boygirl123456
Credentials
-
Protocol
ftp
-
Host
ftp://66.45.232.205/
-
Port
21
-
Username
-
Password
boygirl123456
Targets
-
- Target Delivery Note - AWD 200837363738-3383736363.exe
- Size 1.5MB
- SHA256 27a269f6ae5d574c36867a138c2edb49c8bc680453f97f2dc497d8f166bbba37
- MD5 80dfd8475203bc4c4c8b19925619689d
- SHA1 56de10e20deb363f56e4600bbbfbe3c63e40bc7b
- SHA512 e1ae0497ec1e6798c6675d2d2bbb76197f6b609cafc8416f6d1117867edea70b29dd757678930e3c3d57752d198485401b1becb349426ba30d809956c04243bd
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext