General
- Target Purchase Order details.exe
- Size 404KB
- Sample201109-mdb5pyy7pe
- SHA256 e5027e37e1d918b509ee6bb5b5dfca97f8b71d858d987feb258fde4d3602427a
- MD5 b859a9e6bcc1bd878f462d0d6d348a35
- SHA1 d62558138994c9f2c2b236f599c950fe3d40c5f9
- SHA512 2ba255b368448b728cf47036ed9910e4bf22f38395d62f822581f83e070d0e26f0b8ce5dbc5a7173399c2c4524a255d81b500b8d66485b9c430ef5f7deb80448
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order details.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Purchase Order details.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
chikaaka1
Extracted
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
chikaaka1
Targets
-
- Target Purchase Order details.exe
- Size 404KB
- SHA256 e5027e37e1d918b509ee6bb5b5dfca97f8b71d858d987feb258fde4d3602427a
- MD5 b859a9e6bcc1bd878f462d0d6d348a35
- SHA1 d62558138994c9f2c2b236f599c950fe3d40c5f9
- SHA512 2ba255b368448b728cf47036ed9910e4bf22f38395d62f822581f83e070d0e26f0b8ce5dbc5a7173399c2c4524a255d81b500b8d66485b9c430ef5f7deb80448
- MD5 SHA1 SHA512
Score10/10AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
AgentTesla Payload
Suspicious use of SetThreadContext