General
- Target 173389c1303ed2a3f047a40b5c8e34ad.exe
- Size 755KB
- Sample210221-ew422slp96
- SHA256 954ea9356a580092319e9d42da77cff35db73c2eb7fe8235a6e4124bd9bce120
- MD5 173389c1303ed2a3f047a40b5c8e34ad
- SHA1 422a1508a3c447b62d2ba380c5bde786131edcee
- SHA512 ba996ecb8c74747c9c6838e899be46f360ee82ece95e30e5d54306c74728a8882a166c18ad79860495864a3bb422d41e5dfa514ca9b4e249ef480b4450d80355
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
173389c1303ed2a3f047a40b5c8e34ad.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
173389c1303ed2a3f047a40b5c8e34ad.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
browse9ja
Targets
-
- Target 173389c1303ed2a3f047a40b5c8e34ad.exe
- Size 755KB
- SHA256 954ea9356a580092319e9d42da77cff35db73c2eb7fe8235a6e4124bd9bce120
- MD5 173389c1303ed2a3f047a40b5c8e34ad
- SHA1 422a1508a3c447b62d2ba380c5bde786131edcee
- SHA512 ba996ecb8c74747c9c6838e899be46f360ee82ece95e30e5d54306c74728a8882a166c18ad79860495864a3bb422d41e5dfa514ca9b4e249ef480b4450d80355
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext