General
-
Target
508a4d00f39e78bd22373c949d7f335f
-
Size
1.4MB
-
Sample
210726-x1sg4qpf9a
-
MD5
508a4d00f39e78bd22373c949d7f335f
-
SHA1
78763da01d140f7dce6d513073fe59057a73e8f0
-
SHA256
ab834b3752f0d79eeaebd83c82f5c0b89e293e2fd7d9043fd04f978b34252583
-
SHA512
047a8e4c439bad1ec221439eb6880e55b35bb1bb3c89b75047c9aa7b4ca69a91ac6b8e19842544f2a98688dc128987c0d760d33f59fb17fef8e40d4f7e6579d6
Static task
static1
Behavioral task
behavioral1
Sample
508a4d00f39e78bd22373c949d7f335f.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
508a4d00f39e78bd22373c949d7f335f.exe
Resource
win10v20210408
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
llc@toolscjcurrentlogs.xyz - Password:
JwCWX54321@
Targets
-
-
Target
508a4d00f39e78bd22373c949d7f335f
-
Size
1.4MB
-
MD5
508a4d00f39e78bd22373c949d7f335f
-
SHA1
78763da01d140f7dce6d513073fe59057a73e8f0
-
SHA256
ab834b3752f0d79eeaebd83c82f5c0b89e293e2fd7d9043fd04f978b34252583
-
SHA512
047a8e4c439bad1ec221439eb6880e55b35bb1bb3c89b75047c9aa7b4ca69a91ac6b8e19842544f2a98688dc128987c0d760d33f59fb17fef8e40d4f7e6579d6
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-