General
- Target Scan docs.rar
- Size 511KB
- Sample210527-xg722xp8dn
- SHA256 06edf7ddc282ea3b4f44a968ed79184ae9a9af4d52894f6916e2fe43923b5fe0
- MD5 4ff8bb7a9f01ac5d510b6a5788913165
- SHA1 2bbfd99696559242ebf8a956f0d1547b63f7d0cb
- SHA512 fa301dd41d787d0689c2e25f880fdab31d99b41bf3aa5f01e03da8b803c6465840217241c3d8031a4b9eec3f697739c7657d2dd8987b4142710e1ed32e2765c7
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Scan docs.exe
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Scan docs.exe
Resource
win10v20210410
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.atlmexco.com
-
Port
587
-
Username
-
Password
Yu2220
Targets
-
- Target Scan docs.exe
- Size 695KB
- SHA256 d2578b0374891a585fa4894746bec0b5bc6589b5da8479b423c6fb9d65eaec2a
- MD5 cd483a048e27faf6839f137d37567296
- SHA1 89ae3f2e6720a60319c605afa22dd8e2c01739cd
- SHA512 6678a6bf92d794df620e3ac7b1b8342bbe0bd131f315ffbe0960dfb38333a59627fff2ff316f732293a156828ff543f2b3af35d5270603c750e08c2fbffce972
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext