General
- Target Po-AS47748.exe
- Size 41KB
- Sample220511-pdqtrsgdg2
- SHA256 4963bff2b77dc1a67489feed30040050360b2e06563343383af529a2ca21fc9d
- MD5 ddbdd7db7c1f9786ba4af972861adca2
- SHA1 5c68c3232a413ea1f0d14ebfcbcb616b9a4a00db
- SHA512 92f9f8bf66de5219fce2ac93c268c0aa5c3a152b57f9c6ee3d8b1ca9bcad158f3d606b76cc3ddc91501016ff28f78bbf6a73ecd1d988bf78ef973afa0de95463
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Po-AS47748.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Po-AS47748.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
ftp
-
Host
ftp://ftp.mgcpakistan.com/
-
Port
21
-
Username
-
Password
boygirl123456
Targets
-
- Target Po-AS47748.exe
- Size 41KB
- SHA256 4963bff2b77dc1a67489feed30040050360b2e06563343383af529a2ca21fc9d
- MD5 ddbdd7db7c1f9786ba4af972861adca2
- SHA1 5c68c3232a413ea1f0d14ebfcbcb616b9a4a00db
- SHA512 92f9f8bf66de5219fce2ac93c268c0aa5c3a152b57f9c6ee3d8b1ca9bcad158f3d606b76cc3ddc91501016ff28f78bbf6a73ecd1d988bf78ef973afa0de95463
- MD5 SHA1 SHA512
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext