General
- Target MOA INVOICE_10121345.exe
- Size 1.4MB
- Sample201109-e3kvghnncs
- SHA256 543f935852d249ad9f5e15796a366bec0c560a6fb4d0980525a030029f31a220
- MD5 26e4021e090e38b78648998ede7a1cea
- SHA1 214c3598e1685254f9d4f374042cf94157c18b63
- SHA512 7a6ee1c198f471653c92ceb94d361927738eb18cbf7e3697e8c7e5eaf323d5ea0521dbdacfdb04bab491ad9faf0d28800b74c7dcbf08520ab94a368515f7342b
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
MOA INVOICE_10121345.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
MOA INVOICE_10121345.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
Smtp.yandex.ru
-
Port
587
-
Username
-
Password
shawama1000
Extracted
Credentials
-
Protocol
smtp
-
Host
Smtp.yandex.ru
-
Port
587
-
Username
-
Password
shawama1000
Targets
-
- Target MOA INVOICE_10121345.exe
- Size 1.4MB
- SHA256 543f935852d249ad9f5e15796a366bec0c560a6fb4d0980525a030029f31a220
- MD5 26e4021e090e38b78648998ede7a1cea
- SHA1 214c3598e1685254f9d4f374042cf94157c18b63
- SHA512 7a6ee1c198f471653c92ceb94d361927738eb18cbf7e3697e8c7e5eaf323d5ea0521dbdacfdb04bab491ad9faf0d28800b74c7dcbf08520ab94a368515f7342b
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext