General
- Target PCS.exe
- Size 1.6MB
- Sample210109-r7cea19fre
- SHA256 73b83d70f24909aea7920a86029b43198979d7e31ab768619371e12fc7399f93
- MD5 645c9ff7e36038ca61a401d714a5ceb2
- SHA1 0a3ba9bb37bcb6a11c380bc44c8d4994e3f3bd9b
- SHA512 eac1d8fad5aa56e22b462f3c05c9ebedf113e3b4a2ba2bbac3c116403647e5b59366cc6cf2975e3e64cb1881c03cadc5b3e55ed77672e15a19982ba446906203
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
PCS.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PCS.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.gmail.com
-
Port
587
-
Username
-
Password
princeptlove41999
Targets
-
- Target PCS.exe
- Size 1.6MB
- SHA256 73b83d70f24909aea7920a86029b43198979d7e31ab768619371e12fc7399f93
- MD5 645c9ff7e36038ca61a401d714a5ceb2
- SHA1 0a3ba9bb37bcb6a11c380bc44c8d4994e3f3bd9b
- SHA512 eac1d8fad5aa56e22b462f3c05c9ebedf113e3b4a2ba2bbac3c116403647e5b59366cc6cf2975e3e64cb1881c03cadc5b3e55ed77672e15a19982ba446906203
- MD5 SHA1 SHA512
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext