General
- Target yFtb50HV0L2TX35.exe
- Size 1001KB
- Sample210524-nn3sr2eagj
- SHA256 2a31ce352dedfe83426a33aea06b929ca39d4563434113c0ac4e2d7c1a6eaa0f
- MD5 47ca1c124f94b26b83cdde7b5cddc362
- SHA1 aa89dd38cfdc678ac06f5c489bb7a67cacf392ee
- SHA512 f3710f770dd187e5448e7ba39d12c677e54f14875c00921c4f82ba3b363bee0442c7be8d12b84521b996fff876fc6c11c8f0b7bbbbf4fa761b7591997f161200
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
yFtb50HV0L2TX35.exe
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
yFtb50HV0L2TX35.exe
Resource
win10v20210408
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.nabasaa.com
-
Port
587
-
Username
-
Password
!#aWMOS3
Targets
-
- Target yFtb50HV0L2TX35.exe
- Size 1001KB
- SHA256 2a31ce352dedfe83426a33aea06b929ca39d4563434113c0ac4e2d7c1a6eaa0f
- MD5 47ca1c124f94b26b83cdde7b5cddc362
- SHA1 aa89dd38cfdc678ac06f5c489bb7a67cacf392ee
- SHA512 f3710f770dd187e5448e7ba39d12c677e54f14875c00921c4f82ba3b363bee0442c7be8d12b84521b996fff876fc6c11c8f0b7bbbbf4fa761b7591997f161200
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext