General
- Target 1xNTl3dpzzT4glJ.exe
- Size 887KB
- Sample210524-24hbechbln
- SHA256 12aca308f4e8bf9d42f8f01ac64b171c5851ffc356222feaafab2a84f307de75
- MD5 4dd236947be5e331271f6b6cb4ffea9a
- SHA1 3bb6e42c30552f455f3381696dffc4752d320af8
- SHA512 87ee1d02ffcb6b554a99775b5d6bb973f3ebeb7155e3cfe106b5481bfcb1b782784704d9b4541a6941c9ed689267438d028ad204eccdec6c4a0b9df45c166baa
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
1xNTl3dpzzT4glJ.exe
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1xNTl3dpzzT4glJ.exe
Resource
win10v20210408
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.nabasaa.com
-
Port
587
-
Username
-
Password
!#aWMOS3
Targets
-
- Target 1xNTl3dpzzT4glJ.exe
- Size 887KB
- SHA256 12aca308f4e8bf9d42f8f01ac64b171c5851ffc356222feaafab2a84f307de75
- MD5 4dd236947be5e331271f6b6cb4ffea9a
- SHA1 3bb6e42c30552f455f3381696dffc4752d320af8
- SHA512 87ee1d02ffcb6b554a99775b5d6bb973f3ebeb7155e3cfe106b5481bfcb1b782784704d9b4541a6941c9ed689267438d028ad204eccdec6c4a0b9df45c166baa
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext