General
- Target SecuriteInfo.com.Win64.TrojanX-gen.5069.29528.exe
- Size 481KB
- Sample221109-d8rtrsfbbp
- SHA256 4f28d606adaacc365adde510380b2d5111339ecca6fc7e996d68e6ebb66d29b8
- MD5 eee1816ca0dfeaf7d10126f6413cfba6
- SHA1 84afbab768e381c98919d82cc8bc5bbf0b518d95
- SHA512 ef0ca5e4ea511d83464252fc886d02cbba5939ff08e588db514d94423840921dc5fcfb42e4361fb36ec34d58696085b9e2a7875888a1eb84dee939f0f05c23c3
- SSDEEP 12288:g3YPfrLk/5ipdS8GM0nvu7qbwnPHDpvHozqMkX4:FnkBgdS8GM0mvx2
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win64.TrojanX-gen.5069.29528.exe
Resource
win7-20220812-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win64.TrojanX-gen.5069.29528.exe
Resource
win10v2004-20220901-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.privateemail.com
-
Port
587
-
Username
-
Password
111aaa@@@
Targets
-
- Target SecuriteInfo.com.Win64.TrojanX-gen.5069.29528.exe
- Size 481KB
- SHA256 4f28d606adaacc365adde510380b2d5111339ecca6fc7e996d68e6ebb66d29b8
- MD5 eee1816ca0dfeaf7d10126f6413cfba6
- SHA1 84afbab768e381c98919d82cc8bc5bbf0b518d95
- SHA512 ef0ca5e4ea511d83464252fc886d02cbba5939ff08e588db514d94423840921dc5fcfb42e4361fb36ec34d58696085b9e2a7875888a1eb84dee939f0f05c23c3
- SSDEEP 12288:g3YPfrLk/5ipdS8GM0nvu7qbwnPHDpvHozqMkX4:FnkBgdS8GM0mvx2
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext