General
- Target 4fd47345fcaa5d27cbc328b1d7350f63.exe
- Size 1.4MB
- Sample210802-v68vfj96da
- SHA256 ba9469e7cfecfe460c5f424bc38d0e64cc417b71d7675f46e54e3d9f3b5d03d6
- MD5 4fd47345fcaa5d27cbc328b1d7350f63
- SHA1 371186ceab4bc509203bb76c024fa72d90bce653
- SHA512 23c9bcd123dcbe9102b8ebb54365f0208df1f60aa893529bf49d51967f1d740ee13324c569eeb575c0045fc1b9a5897cf9bad1f4d187eb22531604c2dcc26976
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
4fd47345fcaa5d27cbc328b1d7350f63.exe
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4fd47345fcaa5d27cbc328b1d7350f63.exe
Resource
win10v20210410
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
C2
-
https://api.telegram.org/bot1846829589:AAHSsEDTKvDOQ17YrNRY5_FXv5z4mpfGRIc/sendDocument
Targets
-
- Target 4fd47345fcaa5d27cbc328b1d7350f63.exe
- Size 1.4MB
- SHA256 ba9469e7cfecfe460c5f424bc38d0e64cc417b71d7675f46e54e3d9f3b5d03d6
- MD5 4fd47345fcaa5d27cbc328b1d7350f63
- SHA1 371186ceab4bc509203bb76c024fa72d90bce653
- SHA512 23c9bcd123dcbe9102b8ebb54365f0208df1f60aa893529bf49d51967f1d740ee13324c569eeb575c0045fc1b9a5897cf9bad1f4d187eb22531604c2dcc26976
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext