General
-
Target
Ref 10M-86776.zip
-
Size
645KB
-
Sample
210722-aafvyczq3s
-
MD5
569c5034055681e0b6fe61e6aed888d0
-
SHA1
d5336c0129b6047d9d725e6b72fb2681d720d41f
-
SHA256
8ed5b07f6059f515eb428156e40bf1e192ec7cfde40fa64d0938b7edea8fd3e9
-
SHA512
aeac1d94e0f631056a46dffdc07f3155f8023a06b66161defb96c2b0ac0764d402e4bf216cda318dd3fffc6cc062d0449828d923c63a1efe0147b022766a37b0
Static task
static1
Behavioral task
behavioral1
Sample
Ref 10M-86776.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Ref 10M-86776.exe
Resource
win10v20210408
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
webmail.ombakparadise.com - Port:
587 - Username:
ce@ombakparadise.com - Password:
ce$%^mirah
Targets
-
-
Target
Ref 10M-86776.exe
-
Size
1.0MB
-
MD5
b6e7578868743fb3b695b388dcce06b2
-
SHA1
1632882505f3f76b0962e767da08623357a59372
-
SHA256
dd2262c470cbff3cef7f965e0c457de414eb71bb0ad94ffc2d64aef577462d14
-
SHA512
00a75a815838c1ebb912456fc70d43a7a8f5cca76c2d9a355af047975e5de5d5511f04d80685397e12a0057e9141d1595055e69e5c90dd290d9f6637c888469b
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-