General
- Target 60c40f266129407afdf825322b69dcb3.exe
- Size 509KB
- Sample220623-grf8gsefh5
- SHA256 c2aa6f1c088f58989849749905fd795eb7bf920d6482fcb49bf3a3a3d0d7c8ca
- MD5 60c40f266129407afdf825322b69dcb3
- SHA1 c923567554d5160ce1b2528300a06a84943e2dbe
- SHA512 4557822162c97a7467f46d214efb00a549280f2724678b93ba03ddaa1d759243aea2f83b41c236fe4177293367c447590dd6cece7b6c513cb29ec583c6633f65
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
60c40f266129407afdf825322b69dcb3.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
60c40f266129407afdf825322b69dcb3.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.botswlogistics.com
-
Port
587
-
Username
-
Password
*(QSTCj8
Targets
-
- Target 60c40f266129407afdf825322b69dcb3.exe
- Size 509KB
- SHA256 c2aa6f1c088f58989849749905fd795eb7bf920d6482fcb49bf3a3a3d0d7c8ca
- MD5 60c40f266129407afdf825322b69dcb3
- SHA1 c923567554d5160ce1b2528300a06a84943e2dbe
- SHA512 4557822162c97a7467f46d214efb00a549280f2724678b93ba03ddaa1d759243aea2f83b41c236fe4177293367c447590dd6cece7b6c513cb29ec583c6633f65
- MD5 SHA1 SHA512
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext