General
-
Target
Wire Transer US$ 22,844.77.zip
-
Size
432KB
-
Sample
210226-8mbf3dbdz6
-
MD5
1cd233558a8910e7642de052acd9ae55
-
SHA1
2c7033a5a1ef1db8f6360cce3eea20be302c8803
-
SHA256
c154b4e497bbab9ec874e42118bd4e70d069d3ec8a0ddb07f6e283832c88ac1d
-
SHA512
ee9aff7e905d8a2e5e09bfc32179a44e822ce3e546461e5420ea1bc7cd789c530e768f7dba9e8e0b506a6d0bc6a855d0ae2f87c4c148776f709e5f608deec82b
Static task
static1
Behavioral task
behavioral1
Sample
Wire Transer US$ 22,844.77.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Wire Transer US$ 22,844.77.exe
Resource
win10v20201028
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.shakurjay.com - Port:
587 - Username:
[email protected] - Password:
zpwXtxm7
Targets
-
-
Target
Wire Transer US$ 22,844.77.exe
-
Size
745KB
-
MD5
6de3a6009802993ff970dc10e8fe277e
-
SHA1
d01591e69dc28109e2b7526200f98925adb96a46
-
SHA256
c1b59d6c05f067ca2939198c771b59c2926056583ee185beefe3793f32986b53
-
SHA512
ff6f49fd5f8b686f1df35e5f0795d990c20c4f0144a83baea47fd843ccdb90d18bca8dcefad4057b5a678fc4f63109d69f123e30c7395ddadd2c272fc263ff96
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-