General
- Target Deliver Note- AWD 20008766543-543939939223232.exe
- Size 1.4MB
- Sample201109-5bnm673xta
- SHA256 fa029f3f149b2c256dd41171fad7844d28eacc04e2c26eaddc7de608824f1910
- MD5 6fa946c6b457f2cee6ebe13fbfa54e85
- SHA1 085f385c770f23e17d0fb881f614b6b4398ff59d
- SHA512 7103b6bf6a5375975efa8d834136b8f1832f5cef24f60b144899c5054a69838c2d06dad43743bd913f6a2517b9e6b7e4f154583210461dd681387b9fc83012e3
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Deliver Note- AWD 20008766543-543939939223232.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Deliver Note- AWD 20008766543-543939939223232.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
ftp
-
Host
ftp://66.45.232.205/
-
Port
21
-
Username
-
Password
boygirl123456
Credentials
-
Protocol
ftp
-
Host
ftp://66.45.232.205/
-
Port
21
-
Username
-
Password
boygirl123456
Targets
-
- Target Deliver Note- AWD 20008766543-543939939223232.exe
- Size 1.4MB
- SHA256 fa029f3f149b2c256dd41171fad7844d28eacc04e2c26eaddc7de608824f1910
- MD5 6fa946c6b457f2cee6ebe13fbfa54e85
- SHA1 085f385c770f23e17d0fb881f614b6b4398ff59d
- SHA512 7103b6bf6a5375975efa8d834136b8f1832f5cef24f60b144899c5054a69838c2d06dad43743bd913f6a2517b9e6b7e4f154583210461dd681387b9fc83012e3
- MD5 SHA1 SHA512
Score10/10AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
AgentTesla Payload
Suspicious use of SetThreadContext