General
- Target Invoice 08574.zip
- Size 759KB
- Sample210414-m23vjlsx8a
- SHA256 a79f60aebd0f2c456f54ee9d64575ced0093deadef3c533ef9a67c55a0c3f6ac
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
premium124.web-hosting.com
-
Port
587
-
Username
-
Password
somtochukwu12345
Targets
-
- Target Rq61Y5RcwlxFtxe.exe
- Size 906KB
- SHA256 e178c5e353b39f8ccccc29743235e6d4b665c8dca955ba30da70fdf275a9e30f
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Suspicious use of SetThreadContext