General
- Target Shipping_DocumentsINV.exe
- Size 943KB
- Sample210616-trgztf9he2
- SHA256 3a2a9cfdbd61a0059dfc842bf5333d9548d205d7c6313ef12be7840df044fc87
- MD5 fda5e2e3c164ba233fea76bdf4bbbbaa
- SHA1 631ca5dc850945d00be29efbbd601712ab8e8f27
- SHA512 9841c8561c9c3d4453513ab0192ffe63ae5be22cc50f88e90a859da263b69e80dd267d055e9187106417d45a8d7e0c704376d46370280cc897bec5f84c1dbd0f
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Shipping_DocumentsINV.exe
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Shipping_DocumentsINV.exe
Resource
win10v20210410
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.poolcoempany.com
-
Port
587
-
Username
-
Password
$VrwtB*1
Targets
-
- Target Shipping_DocumentsINV.exe
- Size 943KB
- SHA256 3a2a9cfdbd61a0059dfc842bf5333d9548d205d7c6313ef12be7840df044fc87
- MD5 fda5e2e3c164ba233fea76bdf4bbbbaa
- SHA1 631ca5dc850945d00be29efbbd601712ab8e8f27
- SHA512 9841c8561c9c3d4453513ab0192ffe63ae5be22cc50f88e90a859da263b69e80dd267d055e9187106417d45a8d7e0c704376d46370280cc897bec5f84c1dbd0f
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext