General
- Target Qatar Order.exe
- Size 952KB
- Sample200806-ca1blh6mv6
- SHA256 f9d23884ea2c8b181615c7e0eaeee633d85d5c7c76ed347ce02fb89c5529ebe7
- MD5 35886dda90c82b5777f9173b5d0182ff
- SHA1 9a6db6e787d57f5f29ac88bea46377f9b19f7d3d
- SHA512 053512ab2f50c2c5639a969abab077a56aaa7c9f77f6710a2ce503d5a21ea6c6a706cb1f698ec092c9afd511c8189fbb5e7eaf59de668d4fa6d55890c93f62ba
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Qatar Order.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Qatar Order.exe
Resource
win10v200722
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.privateemail.com
-
Port
587
-
Username
-
Password
Remember@123#
Targets
-
- Target Qatar Order.exe
- Size 952KB
- SHA256 f9d23884ea2c8b181615c7e0eaeee633d85d5c7c76ed347ce02fb89c5529ebe7
- MD5 35886dda90c82b5777f9173b5d0182ff
- SHA1 9a6db6e787d57f5f29ac88bea46377f9b19f7d3d
- SHA512 053512ab2f50c2c5639a969abab077a56aaa7c9f77f6710a2ce503d5a21ea6c6a706cb1f698ec092c9afd511c8189fbb5e7eaf59de668d4fa6d55890c93f62ba
- MD5 SHA1 SHA512
Score10/10AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
AgentTesla Payload
Suspicious use of SetThreadContext