General
- Target SecuriteInfo.com.W32.AIDetectNet.01.21083.3777
- Size 675KB
- Sample220608-d8sq3affbr
- SHA256 5a32cc367669d0ab7fd55f6262fddf6395bfe71124683f15bf8f1497eb5d4a42
- MD5 2023e4a74a791a31433526487a46a7ec
- SHA1 e50d3b30b6e7c0009f469e5ea9ce0ba17b543b98
- SHA512 74d1d6cbd55439f256657acc5a084b7f905be3d3c80dfb1d39fdfb5941b108f4cc7cf00482841c21c9b7b7166a96754ab6988a1eea0be9c13cb5a48113c32bf0
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetectNet.01.21083.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.W32.AIDetectNet.01.21083.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.sunwaysbioscience.com
-
Port
587
-
Username
-
Password
yathin@sunways123
Targets
-
- Target SecuriteInfo.com.W32.AIDetectNet.01.21083.3777
- Size 675KB
- SHA256 5a32cc367669d0ab7fd55f6262fddf6395bfe71124683f15bf8f1497eb5d4a42
- MD5 2023e4a74a791a31433526487a46a7ec
- SHA1 e50d3b30b6e7c0009f469e5ea9ce0ba17b543b98
- SHA512 74d1d6cbd55439f256657acc5a084b7f905be3d3c80dfb1d39fdfb5941b108f4cc7cf00482841c21c9b7b7166a96754ab6988a1eea0be9c13cb5a48113c32bf0
- MD5 SHA1 SHA512
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext