General
- Target Ordem de Compra_Ref_6842_82917.exe
- Size 1.4MB
- Sample201109-c3229mrexe
- SHA256 2929bd7e338ae0270746e4b60faa44c0f5d3d34c4d166964ce013100bafbf1a3
- MD5 86b6b20a62c70f0be4cc5236b45a4fc8
- SHA1 dcc7a23fe49ea375ed2215939607756276dd0bbe
- SHA512 fb453e32af5d8e3e1a7396165b516eb2f49c81ccaa6ba47f8e46ca0046513b0d9b8431090176bd2eb2164d6e23b03d264121622a260ce0ee93a055b1982f2ab0
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Ordem de Compra_Ref_6842_82917.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Ordem de Compra_Ref_6842_82917.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.erkonsentre.com
-
Port
587
-
Username
-
Password
mrObvWV9
Extracted
Credentials
-
Protocol
smtp
-
Host
smtp.erkonsentre.com
-
Port
587
-
Username
-
Password
mrObvWV9
Targets
-
- Target Ordem de Compra_Ref_6842_82917.exe
- Size 1.4MB
- SHA256 2929bd7e338ae0270746e4b60faa44c0f5d3d34c4d166964ce013100bafbf1a3
- MD5 86b6b20a62c70f0be4cc5236b45a4fc8
- SHA1 dcc7a23fe49ea375ed2215939607756276dd0bbe
- SHA512 fb453e32af5d8e3e1a7396165b516eb2f49c81ccaa6ba47f8e46ca0046513b0d9b8431090176bd2eb2164d6e23b03d264121622a260ce0ee93a055b1982f2ab0
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext