General
- Target SecuriteInfo.com.Trojan0056a1fe1.20738.27077
- Size 290KB
- Sample220809-lr7snagdep
- SHA256 fcebb36035585f1e54deb8621271ebdf13ed6345f4e6a4e5ec6e1acbb7378161
- MD5 ba5210aa99ba69fed0545eb50af96404
- SHA1 1aa2620217115455567bd9b00160f74fbb445ce6
- SHA512 e910929e51ef581a1e7f5684ed533b81e85734137245b09741b8e5154be40dde90e9e89b460337b37b916b64f934f33c7ab929a3759305e6fbb6ffcd7f523e55
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan0056a1fe1.20738.exe
Resource
win7-20220718-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan0056a1fe1.20738.exe
Resource
win10v2004-20220721-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.nutiribio.com
-
Port
587
-
Username
-
Password
zGNVO(l5
Targets
-
- Target SecuriteInfo.com.Trojan0056a1fe1.20738.27077
- Size 290KB
- SHA256 fcebb36035585f1e54deb8621271ebdf13ed6345f4e6a4e5ec6e1acbb7378161
- MD5 ba5210aa99ba69fed0545eb50af96404
- SHA1 1aa2620217115455567bd9b00160f74fbb445ce6
- SHA512 e910929e51ef581a1e7f5684ed533b81e85734137245b09741b8e5154be40dde90e9e89b460337b37b916b64f934f33c7ab929a3759305e6fbb6ffcd7f523e55
- MD5 SHA1 SHA512
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext