General
-
Target
SIGN_AND.EXE
-
Size
717KB
-
Sample
211024-nk1f4sdgg4
-
MD5
4cc0def143dc2acc2bf653dc3d69f1c5
-
SHA1
20a739bf4278016e0ee4563685e0cd3d8521aa2d
-
SHA256
271170cb7b83cb6365facd500c213e5cd2efb157288fd58281ec84d19a6f357a
-
SHA512
68e5cbb9847e7a1f4991aca0693130ee937ad704acbfc16d33b12035d88fae797151bb815165019e4b8342ec33ed8085b5c99b8e5b023f3384d700771be53a70
Static task
static1
Behavioral task
behavioral1
Sample
SIGN_AND.EXE
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
SIGN_AND.EXE
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bulletproofprotections.com - Port:
587 - Username:
[email protected] - Password:
Everest10account
Targets
-
-
Target
SIGN_AND.EXE
-
Size
717KB
-
MD5
4cc0def143dc2acc2bf653dc3d69f1c5
-
SHA1
20a739bf4278016e0ee4563685e0cd3d8521aa2d
-
SHA256
271170cb7b83cb6365facd500c213e5cd2efb157288fd58281ec84d19a6f357a
-
SHA512
68e5cbb9847e7a1f4991aca0693130ee937ad704acbfc16d33b12035d88fae797151bb815165019e4b8342ec33ed8085b5c99b8e5b023f3384d700771be53a70
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-