General
-
Target
PURCHASE ORDER-890003.r00
-
Size
573KB
-
Sample
210722-38hr2nlhga
-
MD5
7d3a9e753d73e64f6593babb4a50f749
-
SHA1
e9c69ad8c1441f149af0f2271b15c9589eef02bf
-
SHA256
72ae99647b3d5a4ea568cf9091544ca96bbab701e5e275e88b37eef3b98f51ce
-
SHA512
9294dcbf62bf415fdef1c5cdf9de83a9a04e0bb6d2c424ef722cb035bcbcbafdf4160b756d280d72aaa6800c20882a85f432ac8b344b26e232c3f3425d73ee29
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER-890003.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
PURCHASE ORDER-890003.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.scottbyscott.com - Port:
587 - Username:
ideshow@eflownutrition.com - Password:
ngozi8989
Targets
-
-
Target
PURCHASE ORDER-890003.exe
-
Size
833KB
-
MD5
a72443c2ed0344ee479b1ab6f5ad151b
-
SHA1
a9801f7b05736f67d75f1e78bc0957fd32c439ca
-
SHA256
2d858522bfce2071f029aa5afea4dbaea3dafbfc4ae140671ffdba3bfa5cf82e
-
SHA512
1f5b6d1c4eef27ab969a307f128a855df0c28be1061b4a9fc7127b41f715f019d2832ecaf00ed3725a158acfae1ab0587507e3d05a881ea1d6744805cd3249e3
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-