General
-
Target
Wire Transer US$ 22,844.77.exe
-
Size
745KB
-
Sample
210226-tfmpgpzn3j
-
MD5
6de3a6009802993ff970dc10e8fe277e
-
SHA1
d01591e69dc28109e2b7526200f98925adb96a46
-
SHA256
c1b59d6c05f067ca2939198c771b59c2926056583ee185beefe3793f32986b53
-
SHA512
ff6f49fd5f8b686f1df35e5f0795d990c20c4f0144a83baea47fd843ccdb90d18bca8dcefad4057b5a678fc4f63109d69f123e30c7395ddadd2c272fc263ff96
Static task
static1
Behavioral task
behavioral1
Sample
Wire Transer US$ 22,844.77.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Wire Transer US$ 22,844.77.exe
Resource
win10v20201028
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.shakurjay.com - Port:
587 - Username:
[email protected] - Password:
zpwXtxm7
Targets
-
-
Target
Wire Transer US$ 22,844.77.exe
-
Size
745KB
-
MD5
6de3a6009802993ff970dc10e8fe277e
-
SHA1
d01591e69dc28109e2b7526200f98925adb96a46
-
SHA256
c1b59d6c05f067ca2939198c771b59c2926056583ee185beefe3793f32986b53
-
SHA512
ff6f49fd5f8b686f1df35e5f0795d990c20c4f0144a83baea47fd843ccdb90d18bca8dcefad4057b5a678fc4f63109d69f123e30c7395ddadd2c272fc263ff96
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-