General
- Target R F Q 2000051165.exe
- Size 358KB
- Sample211110-w5175saab5
- SHA256 597bc341fc0f0a16ac70361ee27efcd43368148154ead38986b674cbe9cdb047
- MD5 4375fe990a321ada15706ce51556f064
- SHA1 0a3477728e475551c7e1061ba596e4bc9ebcb642
- SHA512 2e733b87401e79d36bbc37a81052064612f318bb503f163d6f477272f43b66dcbba743552acbeee26805656a6a4ebfc4c93ca4aa0021f82a8063a785a352fe18
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
R F Q 2000051165.exe
Resource
win7-en-20211014
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
R F Q 2000051165.exe
Resource
win10-en-20211104
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.ombakparadise.com
-
Port
587
-
Username
-
Password
ce$%^mirah
Targets
-
- Target R F Q 2000051165.exe
- Size 358KB
- SHA256 597bc341fc0f0a16ac70361ee27efcd43368148154ead38986b674cbe9cdb047
- MD5 4375fe990a321ada15706ce51556f064
- SHA1 0a3477728e475551c7e1061ba596e4bc9ebcb642
- SHA512 2e733b87401e79d36bbc37a81052064612f318bb503f163d6f477272f43b66dcbba743552acbeee26805656a6a4ebfc4c93ca4aa0021f82a8063a785a352fe18
- MD5 SHA1 SHA512
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext