General
- Target 05-14-2020 ((GPI) S.A.R.L..exe
- Size 521KB
- Sample201109-ecqa8ers62
- SHA256 c3dc317b25bce9e92fa7db833698fa5ff50ef74f65abbd5e57238cd95b12b01e
- MD5 4c04c5a1dacaf14bd6fbf6819c341103
- SHA1 5095538ea4d9750c7f458b47fb85a84101cff089
- SHA512 58c9a9a15cf86285e8327e828184b8b8cc23d684ef8f6b99c9797b1d5328ae1a3b636035d59f0b490fb7f3813356fa665cfc00f9f1310cae9190f5b669199380
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
05-14-2020 ((GPI) S.A.R.L..exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
05-14-2020 ((GPI) S.A.R.L..exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
Mummy212
Targets
-
- Target 05-14-2020 ((GPI) S.A.R.L..exe
- Size 521KB
- SHA256 c3dc317b25bce9e92fa7db833698fa5ff50ef74f65abbd5e57238cd95b12b01e
- MD5 4c04c5a1dacaf14bd6fbf6819c341103
- SHA1 5095538ea4d9750c7f458b47fb85a84101cff089
- SHA512 58c9a9a15cf86285e8327e828184b8b8cc23d684ef8f6b99c9797b1d5328ae1a3b636035d59f0b490fb7f3813356fa665cfc00f9f1310cae9190f5b669199380
- MD5 SHA1 SHA512
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
AgentTesla Payload
Adds Run key to start application
Suspicious use of SetThreadContext