General
- Target 1SPzJr8VrnDyJyl.exe
- Size 711KB
- Sample201102-mtaadyf1vj
- SHA256 1a45a42350aab874f77e01018c157f7268e78765802ca0e042d44dbc2e039f8f
- MD5 0766e4a17cb43413258812da39508ae4
- SHA1 b7ec66e333487f9925f548615687327d8073bc00
- SHA512 9b4d84685b396108d2883cf831989014fd378612149ed56c81907b2e96aed0c200148766b184bcc3fdaee85e67bf224343a9e751d950a4a65f6307198748b007
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
1SPzJr8VrnDyJyl.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1SPzJr8VrnDyJyl.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.sardaplywood.com
-
Port
587
-
Username
-
Password
sup123st45
Targets
-
- Target 1SPzJr8VrnDyJyl.exe
- Size 711KB
- SHA256 1a45a42350aab874f77e01018c157f7268e78765802ca0e042d44dbc2e039f8f
- MD5 0766e4a17cb43413258812da39508ae4
- SHA1 b7ec66e333487f9925f548615687327d8073bc00
- SHA512 9b4d84685b396108d2883cf831989014fd378612149ed56c81907b2e96aed0c200148766b184bcc3fdaee85e67bf224343a9e751d950a4a65f6307198748b007
- MD5 SHA1 SHA512
Score10/10AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
AgentTesla Payload
Suspicious use of SetThreadContext