General
- Target f4dcb6c507e845e16a5ee461792def83.exe
- Size 463KB
- Sample210331-9j1x9e82wn
- SHA256 b821cdf6b8cdb33d9f033ef0c5d444aedb5767ddf8c1faa87c79d7e7193e6d32
- MD5 f4dcb6c507e845e16a5ee461792def83
- SHA1 8a2b1d71feaf9dbaca3fd4a868f6e71d498707ae
- SHA512 d452c219a549de8418d9b5eedd2b27ed592f544c8e72d49275d320fb632cc5d3c381ad230489927ac9e1cb0e8362f0f43c8d2802ec42da5e3bc0c3c22118f11c
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
f4dcb6c507e845e16a5ee461792def83.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f4dcb6c507e845e16a5ee461792def83.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
browse9ja
Targets
-
- Target f4dcb6c507e845e16a5ee461792def83.exe
- Size 463KB
- SHA256 b821cdf6b8cdb33d9f033ef0c5d444aedb5767ddf8c1faa87c79d7e7193e6d32
- MD5 f4dcb6c507e845e16a5ee461792def83
- SHA1 8a2b1d71feaf9dbaca3fd4a868f6e71d498707ae
- SHA512 d452c219a549de8418d9b5eedd2b27ed592f544c8e72d49275d320fb632cc5d3c381ad230489927ac9e1cb0e8362f0f43c8d2802ec42da5e3bc0c3c22118f11c
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext