General
- Target SCAN_310.EXE
- Size 690KB
- Sample210401-yghaskdd5j
- SHA256 37a8d6589b8cbbf567ccb5686ea0c4486eabbd6078089a6829fd109a77d4e2e3
- MD5 eb1db92108eb6d91d2964d237490f7c0
- SHA1 b0c406c4253b409c458eab880f83818208fc4932
- SHA512 bb1d6236086e9f17d07d20105252d39ff186a65f9406275056bb95d1c4d3e91d46e5d3ca50692475e26c5deec8ff45735a7778f73c580ddde36c0c0fb2f08ae0
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
SCAN_310.EXE
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SCAN_310.EXE
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.proexpertint.com.sa
-
Port
587
-
Username
-
Password
proexpert123$
Targets
-
- Target SCAN_310.EXE
- Size 690KB
- SHA256 37a8d6589b8cbbf567ccb5686ea0c4486eabbd6078089a6829fd109a77d4e2e3
- MD5 eb1db92108eb6d91d2964d237490f7c0
- SHA1 b0c406c4253b409c458eab880f83818208fc4932
- SHA512 bb1d6236086e9f17d07d20105252d39ff186a65f9406275056bb95d1c4d3e91d46e5d3ca50692475e26c5deec8ff45735a7778f73c580ddde36c0c0fb2f08ae0
- MD5 SHA1 SHA512
Score10/10AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
AgentTesla Payload
Suspicious use of SetThreadContext