General
-
Target
eef493591f19e528c080282c96fa823b.exe
-
Size
23KB
-
Sample
210421-t45xant5ax
-
MD5
eef493591f19e528c080282c96fa823b
-
SHA1
47622fc750c6c7c66c5ebdca66df8828585f8945
-
SHA256
98a0f70bad8b8d6877acaa0ae9d7e70127126e815db3ac71ae3492309114b6be
-
SHA512
02c6b75a6deb5928097f9b70f073c9872239c2eb7bb636b1c93354711ee6f1871bf1926f2ca82fa322e183436b2e5f27aa32ceaf6624fc61f0daf474c91cdb76
Static task
static1
Behavioral task
behavioral1
Sample
eef493591f19e528c080282c96fa823b.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
eef493591f19e528c080282c96fa823b.exe
Resource
win10v20210408
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
binatonezx.cf - Port:
587 - Username:
arinzelogs@binatonezx.cf - Password:
7213575aceACE@#$
Targets
-
-
Target
eef493591f19e528c080282c96fa823b.exe
-
Size
23KB
-
MD5
eef493591f19e528c080282c96fa823b
-
SHA1
47622fc750c6c7c66c5ebdca66df8828585f8945
-
SHA256
98a0f70bad8b8d6877acaa0ae9d7e70127126e815db3ac71ae3492309114b6be
-
SHA512
02c6b75a6deb5928097f9b70f073c9872239c2eb7bb636b1c93354711ee6f1871bf1926f2ca82fa322e183436b2e5f27aa32ceaf6624fc61f0daf474c91cdb76
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-