General
- Target 3448bfcf86f2f05482276c14f1453b81.exe
- Size 688KB
- Sample220623-grf8gsbhfk
- SHA256 1d0c844dd635dcdee374b276dd0d40b89dd000babecf14460f5857748474ff04
- MD5 3448bfcf86f2f05482276c14f1453b81
- SHA1 d47d80e7d4bc22838de8baabf8ed8faba162c9f3
- SHA512 bf8a4613988a479c5b7d99805e9b4c14de03c15866b4ffb358dcc4a36adc2de3ed8c97113bd4203a4d77fa775c1ae407b8fcb7ea63fabd9f3d82066340435493
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
3448bfcf86f2f05482276c14f1453b81.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3448bfcf86f2f05482276c14f1453b81.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.botswlogistics.com
-
Port
587
-
Username
-
Password
*(QSTCj8
Targets
-
- Target 3448bfcf86f2f05482276c14f1453b81.exe
- Size 688KB
- SHA256 1d0c844dd635dcdee374b276dd0d40b89dd000babecf14460f5857748474ff04
- MD5 3448bfcf86f2f05482276c14f1453b81
- SHA1 d47d80e7d4bc22838de8baabf8ed8faba162c9f3
- SHA512 bf8a4613988a479c5b7d99805e9b4c14de03c15866b4ffb358dcc4a36adc2de3ed8c97113bd4203a4d77fa775c1ae407b8fcb7ea63fabd9f3d82066340435493
- MD5 SHA1 SHA512
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext