General
-
Target
Purchase Oder List.exe
-
Size
641KB
-
Sample
210727-w4asb6vp5a
-
MD5
d4ac2e301d054744db922f396d497a1f
-
SHA1
0a580a7ca5e1e2128ab507e644df45c54d939192
-
SHA256
fdaff5b7230a045f22dcafc4da592c42c3386770c58757cc825a99fcef5f1f78
-
SHA512
727f62c850bfad6d682d33f4aafa2a4442155b573f6b8fea8ba2c5d68617d4272e2e54083126bb1e8e712ce5acfbd543663268092ec24c422512450509d61cc0
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Oder List.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Purchase Oder List.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
webmail.ipissbgroup.com - Port:
587 - Username:
cuttycool@ipissbgroup.com - Password:
Possiblegod12345
Targets
-
-
Target
Purchase Oder List.exe
-
Size
641KB
-
MD5
d4ac2e301d054744db922f396d497a1f
-
SHA1
0a580a7ca5e1e2128ab507e644df45c54d939192
-
SHA256
fdaff5b7230a045f22dcafc4da592c42c3386770c58757cc825a99fcef5f1f78
-
SHA512
727f62c850bfad6d682d33f4aafa2a4442155b573f6b8fea8ba2c5d68617d4272e2e54083126bb1e8e712ce5acfbd543663268092ec24c422512450509d61cc0
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Suspicious use of SetThreadContext
-