General
-
Target
Payment slip.exe
-
Size
664KB
-
Sample
211023-mbcs1sccd2
-
MD5
da1c1f2acf3ceaf318b88595c6fcd3e2
-
SHA1
c1b33299ce801bdf1ec02e5125dcb018a751c0e8
-
SHA256
e49f212d6e5f137cf1394c1bce43b0d84c1a982b0a52e43d27d8cd45692764b7
-
SHA512
21ba66ae3eb417f53a140a600dea660cdc6e951cac372a6993ebdde62ec61acecfa44589b9d9e4ecc61eefe87bb05c3fdee29e1dfec44ba45f39ea5a69b860c9
Static task
static1
Behavioral task
behavioral1
Sample
Payment slip.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Payment slip.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
[email protected] - Password:
Everest10
Targets
-
-
Target
Payment slip.exe
-
Size
664KB
-
MD5
da1c1f2acf3ceaf318b88595c6fcd3e2
-
SHA1
c1b33299ce801bdf1ec02e5125dcb018a751c0e8
-
SHA256
e49f212d6e5f137cf1394c1bce43b0d84c1a982b0a52e43d27d8cd45692764b7
-
SHA512
21ba66ae3eb417f53a140a600dea660cdc6e951cac372a6993ebdde62ec61acecfa44589b9d9e4ecc61eefe87bb05c3fdee29e1dfec44ba45f39ea5a69b860c9
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-