General
- Target CATLOGUE.exe
- Size 240KB
- Sample210921-arrwnaffe4
- SHA256 db48a21a6f575ca9f5faddfa9fe6f72e0b261579b2e0182440c7a2dbb943b355
- MD5 fafeb784d7ac5fcce8df74a9015cb660
- SHA1 2aca288c2ebc458d6bef97f7e26ea78d85c78312
- SHA512 8e33ea86985cbab4f88f210b47b7764239a41e9ae7179142167b828150fb2d4637f807435c85b4e3556e74e65d7c8b4bf856314dcc31de3b620c7b22902546bc
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
CATLOGUE.exe
Resource
win7-en-20210920
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
CATLOGUE.exe
Resource
win10v20210408
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.medicare-equipment.com
-
Port
587
-
Username
-
Password
AllTheBest777
Targets
-
- Target CATLOGUE.exe
- Size 240KB
- SHA256 db48a21a6f575ca9f5faddfa9fe6f72e0b261579b2e0182440c7a2dbb943b355
- MD5 fafeb784d7ac5fcce8df74a9015cb660
- SHA1 2aca288c2ebc458d6bef97f7e26ea78d85c78312
- SHA512 8e33ea86985cbab4f88f210b47b7764239a41e9ae7179142167b828150fb2d4637f807435c85b4e3556e74e65d7c8b4bf856314dcc31de3b620c7b22902546bc
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext