General
- Target Bank TT copy.iso
- Size 1.1MB
- Sample210607-6axt62dcas
- SHA256 02186db1c17ea577ba1a0f03b9e69f4fb0cb41eeaa9ee11aa0d2979c0fa81c66
- MD5 2ffa76c6a24cfaa0ff1d4b8499b982e3
- SHA1 feb30a0b4ad170bb4f56b168e32eb5b8c8abbdf2
- SHA512 7881799fe59fe2de2f859d28534f93f4d43a55f90c5cec5dd8ba8353fee17cec3796b916aaf20d196f7957841976a734dca7ac6491eccf0c523bc5e5a2aca9d6
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
z3PO7kPTIXRKq8A.exe
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
z3PO7kPTIXRKq8A.exe
Resource
win10v20210410
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtppro.zoho.eu
-
Port
587
-
Username
-
Password
Ezenagu123
Targets
-
- Target z3PO7kPTIXRKq8A.exe
- Size 1.1MB
- SHA256 e709be2a43cf2eac1c6bdfabb2127e8ac9f5bc9f95985d86822cced1f19a8420
- MD5 386b16a13ca2e42e3399147bf743879a
- SHA1 0799f0c90f6f2e70afdd6c06020118b57727630e
- SHA512 bdc86224db1ae27d1b33f64c31110610068ec91ff6e76838d7da5fccff746eea928885b5689c26fa63e291a0844dbcd7c7e9b79a7d7dee45a5404619e8f76b42
- MD5 SHA1 SHA512
Score10/10AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
AgentTesla Payload
Suspicious use of SetThreadContext