General
- Target SHIPPING DOCUMENTS doc.exe
- Size 963KB
- Sample210510-8d55qverg2
- SHA256 969d7de974220c1a8067ff973c359581fa7ff0aba079a8a81537460b4e3810c0
- MD5 8b42029bfe7c8aa966fb1bb9b46bbd7c
- SHA1 25c7d253ec7c7b7922aeb5d615b1494a5be87569
- SHA512 851f1cd67124d458e25b39350d7b9977620286ed4146ad810eee82c3cff72c7f727fe933735f53660daed12531b718247100e369291cb32d6589b5019f6d6eca
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING DOCUMENTS doc.exe
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SHIPPING DOCUMENTS doc.exe
Resource
win10v20210408
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.esquiresweaters.com
-
Port
587
-
Username
-
Password
Esquire@#2078
Targets
-
- Target SHIPPING DOCUMENTS doc.exe
- Size 963KB
- SHA256 969d7de974220c1a8067ff973c359581fa7ff0aba079a8a81537460b4e3810c0
- MD5 8b42029bfe7c8aa966fb1bb9b46bbd7c
- SHA1 25c7d253ec7c7b7922aeb5d615b1494a5be87569
- SHA512 851f1cd67124d458e25b39350d7b9977620286ed4146ad810eee82c3cff72c7f727fe933735f53660daed12531b718247100e369291cb32d6589b5019f6d6eca
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext