General
-
Target
371fd6aeafdcecd9cd4d13681fc60e75
-
Size
747KB
-
Sample
210727-aymz4qhf5x
-
MD5
371fd6aeafdcecd9cd4d13681fc60e75
-
SHA1
5d89e76bd8469d27f95b06209c2615299b5c8117
-
SHA256
e1cb7d89b224add8c1c019b849e4e27db5cc138596091354e441c3c039cc35b0
-
SHA512
170682ff97ef9fb04ebdd093fdaa044e6084a63bb8179e03900d93b74627d0c70a52ca304536722b01f356cf85d67c667663b09c0a5487ee1224e145b5208d61
Static task
static1
Behavioral task
behavioral1
Sample
371fd6aeafdcecd9cd4d13681fc60e75.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
371fd6aeafdcecd9cd4d13681fc60e75.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
cjnew@cjserverlogs2021luck.xyz - Password:
cjcurrent@5000
Targets
-
-
Target
371fd6aeafdcecd9cd4d13681fc60e75
-
Size
747KB
-
MD5
371fd6aeafdcecd9cd4d13681fc60e75
-
SHA1
5d89e76bd8469d27f95b06209c2615299b5c8117
-
SHA256
e1cb7d89b224add8c1c019b849e4e27db5cc138596091354e441c3c039cc35b0
-
SHA512
170682ff97ef9fb04ebdd093fdaa044e6084a63bb8179e03900d93b74627d0c70a52ca304536722b01f356cf85d67c667663b09c0a5487ee1224e145b5208d61
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Suspicious use of SetThreadContext
-