General
- Target 05cf07b2371b30b2645ba9814d4adb8c.exe
- Size 882KB
- Sample210419-hak459farn
- SHA256 9e4a74726f941cbf43534436e6f390e4bf0be3fac3b453d2c1c1940027598327
- MD5 05cf07b2371b30b2645ba9814d4adb8c
- SHA1 fc3c3a699049b81f12850bbf23a8e44e0182b443
- SHA512 51238b586cdb22ac57a488036d7a3bf46f56670408593a5a647449e450740d832264ff084919198f67393b743151a739a29bb77a295816f4e572d9da12cd4443
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
05cf07b2371b30b2645ba9814d4adb8c.exe
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
05cf07b2371b30b2645ba9814d4adb8c.exe
Resource
win10v20210408
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.rompharm.ro
-
Port
587
-
Username
-
Password
CQRoC00+
Targets
-
- Target 05cf07b2371b30b2645ba9814d4adb8c.exe
- Size 882KB
- SHA256 9e4a74726f941cbf43534436e6f390e4bf0be3fac3b453d2c1c1940027598327
- MD5 05cf07b2371b30b2645ba9814d4adb8c
- SHA1 fc3c3a699049b81f12850bbf23a8e44e0182b443
- SHA512 51238b586cdb22ac57a488036d7a3bf46f56670408593a5a647449e450740d832264ff084919198f67393b743151a739a29bb77a295816f4e572d9da12cd4443
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext