General
- Target INVOICE-ECNOG-0987765546799008780975433.scr.exe
- Size 675KB
- Sample210927-nkeveagffp
- SHA256 786a9b90ee6541476ce7b9ffed8a4d22438b7cfc72ec33ddad9a3cf2cb2f8613
- MD5 5d3e9a92eed37f194e32bde55e64ec94
- SHA1 2e74d10921253699b029c79b6544f2108390bd95
- SHA512 229855396a5982baed9bc437d31038ad13d7535bdd420a46bcd54f47b788c469023c26faa8e67720a3a4c46551cab6dab5a5b0015f79bbf540019d15bffd9516
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE-ECNOG-0987765546799008780975433.scr.exe
Resource
win7-en-20210920
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
INVOICE-ECNOG-0987765546799008780975433.scr.exe
Resource
win10v20210408
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.a2zfacilityservices.in
-
Port
587
-
Username
-
Password
?(K8n&m,}#va
Targets
-
- Target INVOICE-ECNOG-0987765546799008780975433.scr.exe
- Size 675KB
- SHA256 786a9b90ee6541476ce7b9ffed8a4d22438b7cfc72ec33ddad9a3cf2cb2f8613
- MD5 5d3e9a92eed37f194e32bde55e64ec94
- SHA1 2e74d10921253699b029c79b6544f2108390bd95
- SHA512 229855396a5982baed9bc437d31038ad13d7535bdd420a46bcd54f47b788c469023c26faa8e67720a3a4c46551cab6dab5a5b0015f79bbf540019d15bffd9516
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext