General
- Target SecuriteInfo.com.W32.MSIL_Kryptik.DLO.genEldorado.1110.25976
- Size 875KB
- Sample210426-stdtbl2cra
- SHA256 9a7cc833405fabd1375ba99a3d19d8ec53243fe3f06b01ba01b2c58c519105df
- MD5 0deb286de1cac13ebd6bb95eb468059b
- SHA1 518a89ef0dc7ca7c7236e93b3081c09d2d88b86f
- SHA512 7a93f7a33ea775eea3e26bb07408d4c2e150beb766cf81611459f72863aa5d66cc83314b0c9d264120a0e424410c80c9011d55d531d54c2df3dc49fec7d03f58
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.MSIL_Kryptik.DLO.genEldorado.1110.25976.exe
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.W32.MSIL_Kryptik.DLO.genEldorado.1110.25976.exe
Resource
win10v20210410
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.safina.cc
-
Port
587
-
Username
-
Password
$ElriMd0
Targets
-
- Target SecuriteInfo.com.W32.MSIL_Kryptik.DLO.genEldorado.1110.25976
- Size 875KB
- SHA256 9a7cc833405fabd1375ba99a3d19d8ec53243fe3f06b01ba01b2c58c519105df
- MD5 0deb286de1cac13ebd6bb95eb468059b
- SHA1 518a89ef0dc7ca7c7236e93b3081c09d2d88b86f
- SHA512 7a93f7a33ea775eea3e26bb07408d4c2e150beb766cf81611459f72863aa5d66cc83314b0c9d264120a0e424410c80c9011d55d531d54c2df3dc49fec7d03f58
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext