General
- Target HYUNDAI_.EXE
- Size 1.4MB
- Sample210304-nek1ba3dps
- SHA256 a67f9172ca1a41d7403d46be868448d83c1c80a1dbdd714b4122a62470ebb00a
- MD5 3d5a358f7cba111bfd2bdda90a43b55e
- SHA1 6d13c740e8a61fe1fe48c85daff15ab9777eb871
- SHA512 26069cd4738343c3ee1044c9d9633ce5f75b9e294da110cab4a2f3bf11090959036ef474008694494ab0a62e8a2cc3eea1d43d60ff9689b814bc461daa83392c
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
HYUNDAI_.EXE
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
HYUNDAI_.EXE
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.lootahperfumes.com
-
Port
587
-
Username
-
Password
clever2018
Targets
-
- Target HYUNDAI_.EXE
- Size 1.4MB
- SHA256 a67f9172ca1a41d7403d46be868448d83c1c80a1dbdd714b4122a62470ebb00a
- MD5 3d5a358f7cba111bfd2bdda90a43b55e
- SHA1 6d13c740e8a61fe1fe48c85daff15ab9777eb871
- SHA512 26069cd4738343c3ee1044c9d9633ce5f75b9e294da110cab4a2f3bf11090959036ef474008694494ab0a62e8a2cc3eea1d43d60ff9689b814bc461daa83392c
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext