General
- Target Order-Confirmation-PO-0756-200-KG xls.scr
- Size 882KB
- Sample210601-z7dp42ejca
- SHA256 af1076fd5339badf56bfabd56b73e09d27c2aa40916499d9cded1f984536f6d9
- MD5 fc25477e7874a702b9a94458c3c3961b
- SHA1 90654524dc754e37c81dd6acbe88d369a25b74d3
- SHA512 5da1b65ddc9b2edb89102003f289ebd53cfaf4b69e858b436909b1698bf9f54eeb11a2f9394e40e3edcdfbc1ed1bdfa9ea76229d40be2a6289be55fb2ece6f65
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Order-Confirmation-PO-0756-200-KG xls.scr
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Order-Confirmation-PO-0756-200-KG xls.scr
Resource
win10v20210410
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.w2opt.com
-
Port
587
-
Username
-
Password
wTwo@2018
Targets
-
- Target Order-Confirmation-PO-0756-200-KG xls.scr
- Size 882KB
- SHA256 af1076fd5339badf56bfabd56b73e09d27c2aa40916499d9cded1f984536f6d9
- MD5 fc25477e7874a702b9a94458c3c3961b
- SHA1 90654524dc754e37c81dd6acbe88d369a25b74d3
- SHA512 5da1b65ddc9b2edb89102003f289ebd53cfaf4b69e858b436909b1698bf9f54eeb11a2f9394e40e3edcdfbc1ed1bdfa9ea76229d40be2a6289be55fb2ece6f65
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext