General
-
Target
5660db4d39e1c2a7887c2b26c2f70f9b.exe
-
Size
349KB
-
Sample
200731-nvrp2kdkzn
-
MD5
5660db4d39e1c2a7887c2b26c2f70f9b
-
SHA1
656e494c33580a04d6ad08749a3f90fb7d4bb131
-
SHA256
322246ebcd55123f8d11816a45dde9ef1b0b041ab306fce78af896a04052e6c8
-
SHA512
66b4d49a740ea69f7a19cebcbad81d9851e0750aff4b18da23726555bcf605082ae25edbee251ca4401049e9759ffe5997b86ad290cba1ba7a9ec2b04dd93d3a
Static task
static1
Behavioral task
behavioral1
Sample
5660db4d39e1c2a7887c2b26c2f70f9b.exe
Resource
win7
Behavioral task
behavioral2
Sample
5660db4d39e1c2a7887c2b26c2f70f9b.exe
Resource
win10
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
safaa.bishara@santemoraegypt.com - Password:
chimaroke2020
Targets
-
-
Target
5660db4d39e1c2a7887c2b26c2f70f9b.exe
-
Size
349KB
-
MD5
5660db4d39e1c2a7887c2b26c2f70f9b
-
SHA1
656e494c33580a04d6ad08749a3f90fb7d4bb131
-
SHA256
322246ebcd55123f8d11816a45dde9ef1b0b041ab306fce78af896a04052e6c8
-
SHA512
66b4d49a740ea69f7a19cebcbad81d9851e0750aff4b18da23726555bcf605082ae25edbee251ca4401049e9759ffe5997b86ad290cba1ba7a9ec2b04dd93d3a
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops startup file
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-