General
-
Target
HTC-343467.exe
-
Size
781KB
-
Sample
210421-q4ydx4te1x
-
MD5
2fbb52eaa4d139882e67b1b4f5bd9744
-
SHA1
fce4de8aba1ab5325b1d4e57678f4e08dcb68d00
-
SHA256
f1624469028a2d29ddceec7ca539472c54787b4047bee8c60cfc8ee2b0c4d89c
-
SHA512
380732049e4c8481265325289e9c233a0e4ef553cf55cdfe62d1a20262e6bba8e531d907e5ddfc8da316170c70e0b3ab3b41426d9fcbc7c4d88eea68284a526b
Static task
static1
Behavioral task
behavioral1
Sample
HTC-343467.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
HTC-343467.exe
Resource
win10v20210408
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.syntrnomh.com - Port:
587 - Username:
rainie.wang@syntrnomh.com - Password:
Tdn$AuZro1
Targets
-
-
Target
HTC-343467.exe
-
Size
781KB
-
MD5
2fbb52eaa4d139882e67b1b4f5bd9744
-
SHA1
fce4de8aba1ab5325b1d4e57678f4e08dcb68d00
-
SHA256
f1624469028a2d29ddceec7ca539472c54787b4047bee8c60cfc8ee2b0c4d89c
-
SHA512
380732049e4c8481265325289e9c233a0e4ef553cf55cdfe62d1a20262e6bba8e531d907e5ddfc8da316170c70e0b3ab3b41426d9fcbc7c4d88eea68284a526b
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-