General
- Target received and accepted.exe
- Size 816KB
- Sample210509-ex7bypt92e
- SHA256 db1758d0ec67aab44814a07b14a7dbc404cae5960e37a446baa3c8cf8c9f442f
- MD5 48dcea15202e89077d31879e8370aa77
- SHA1 c23cece3fe9fc8c7808aca0b682cfc34ca0110c1
- SHA512 2762dcc1f3a332c61a32f0c45ee3c5624786e759dda9dd7fd1bb97e001e6baea809aa270b87583de2f13a4d8ea3775725af108d0de27a75e9ad65f12ad44a27a
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
received and accepted.exe
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
received and accepted.exe
Resource
win10v20210408
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.davitecco.com
-
Port
587
-
Username
-
Password
J-y2i7#INlWI
Targets
-
- Target received and accepted.exe
- Size 816KB
- SHA256 db1758d0ec67aab44814a07b14a7dbc404cae5960e37a446baa3c8cf8c9f442f
- MD5 48dcea15202e89077d31879e8370aa77
- SHA1 c23cece3fe9fc8c7808aca0b682cfc34ca0110c1
- SHA512 2762dcc1f3a332c61a32f0c45ee3c5624786e759dda9dd7fd1bb97e001e6baea809aa270b87583de2f13a4d8ea3775725af108d0de27a75e9ad65f12ad44a27a
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext