General
- Target 3ozaNueWcHzTP8s.exe
- Size 1.0MB
- Sample210316-58wshmr3ls
- SHA256 82ce655e59a38e2b2cfd54a152c963b6854cdc0e1e2bd9d83c32f3c989268ed5
- MD5 88577509dc555deddf0df5054eba351e
- SHA1 d81997ac7f6e1fc7ae02dab2b666fa45d5a13cd4
- SHA512 efec5ec1afa0012024ba7473e02a50059b668214b49f9524232656e32b7373d99e6fa27db0a1d4ddb8a614aa1f7b7770383ad82c85fe2ba968603f8e67e426d1
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
3ozaNueWcHzTP8s.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3ozaNueWcHzTP8s.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.gaprofessionals.com
-
Port
587
-
Username
-
Password
nHcw~I~()K,?
Targets
-
- Target 3ozaNueWcHzTP8s.exe
- Size 1.0MB
- SHA256 82ce655e59a38e2b2cfd54a152c963b6854cdc0e1e2bd9d83c32f3c989268ed5
- MD5 88577509dc555deddf0df5054eba351e
- SHA1 d81997ac7f6e1fc7ae02dab2b666fa45d5a13cd4
- SHA512 efec5ec1afa0012024ba7473e02a50059b668214b49f9524232656e32b7373d99e6fa27db0a1d4ddb8a614aa1f7b7770383ad82c85fe2ba968603f8e67e426d1
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext