General
- Target Scan copy of said documents.exe
- Size 906KB
- Sample210524-kdk76rvnt2
- SHA256 f4fc2dc5b2fdb55378fc552afdd02c5ba99148de2ae9f1633de95dca70a40d02
- MD5 99188b6f087ecce9876aefd4e16a3595
- SHA1 746e6fb632a6e189f1c9b2c7430c6abf5da597f7
- SHA512 a2ba0fb3e87535bf2aef6788cca112566286c25870cefae307617148a91a721ccca42791cc456da69430013dc362eb5ff980ec14c3f55d5ab09dca160faf2c19
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Scan copy of said documents.exe
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Scan copy of said documents.exe
Resource
win10v20210410
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
ftp
-
Host
ftp://files.000webhost.com/
-
Port
21
-
Username
zinco
-
Password
computer147
Targets
-
- Target Scan copy of said documents.exe
- Size 906KB
- SHA256 f4fc2dc5b2fdb55378fc552afdd02c5ba99148de2ae9f1633de95dca70a40d02
- MD5 99188b6f087ecce9876aefd4e16a3595
- SHA1 746e6fb632a6e189f1c9b2c7430c6abf5da597f7
- SHA512 a2ba0fb3e87535bf2aef6788cca112566286c25870cefae307617148a91a721ccca42791cc456da69430013dc362eb5ff980ec14c3f55d5ab09dca160faf2c19
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext