General
-
Target
BANK CONFIRMATION.exe
-
Size
630KB
-
Sample
210727-9j8y6meltx
-
MD5
1559eb5515eb732de889dcdff24662c9
-
SHA1
69abf00e7e4ab89a0592380413d3d12cfc714cb9
-
SHA256
3984eb9bbb5210eaf04a4bcdfcc1512a58df9d264cf2e8a19377f59d4fd8e55b
-
SHA512
f948ed228ae434d55c9f16ff8ab172463fe621955bf58b79cb37dedde104c3c73757513d5243e06968fc4b655432fa399bcec3eafe75ef44a16fd7978814d350
Static task
static1
Behavioral task
behavioral1
Sample
BANK CONFIRMATION.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
BANK CONFIRMATION.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.saisianket-tech.com - Port:
587 - Username:
akibapen@saisianket-tech.com - Password:
oluwagozie123
Targets
-
-
Target
BANK CONFIRMATION.exe
-
Size
630KB
-
MD5
1559eb5515eb732de889dcdff24662c9
-
SHA1
69abf00e7e4ab89a0592380413d3d12cfc714cb9
-
SHA256
3984eb9bbb5210eaf04a4bcdfcc1512a58df9d264cf2e8a19377f59d4fd8e55b
-
SHA512
f948ed228ae434d55c9f16ff8ab172463fe621955bf58b79cb37dedde104c3c73757513d5243e06968fc4b655432fa399bcec3eafe75ef44a16fd7978814d350
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-