General
- Target SOA_31052021.exe
- Size 704KB
- Sample210608-4rhmsg8pwx
- SHA256 000c48c69a95af7c9fad89243b2c2bf7224196f6e4cc69775b9f93fd86aced49
- MD5 fb8ce74713f8657be1de1fceaf9e2f31
- SHA1 4f08b69991806818ac04b7cd5fbabbf07047b7f2
- SHA512 f202f658497277e5b1e017b6b7afa44852313903468f1bc958600046d5c7a41b8688e166db2cb4a19b2bc8269c4abd1a758327d01463f3250a44b43aaafb2b3b
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
SOA_31052021.exe
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SOA_31052021.exe
Resource
win10v20210408
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.afciphil.com.ph
-
Port
587
-
Username
-
Password
r35eCaR@t4
Targets
-
- Target SOA_31052021.exe
- Size 704KB
- SHA256 000c48c69a95af7c9fad89243b2c2bf7224196f6e4cc69775b9f93fd86aced49
- MD5 fb8ce74713f8657be1de1fceaf9e2f31
- SHA1 4f08b69991806818ac04b7cd5fbabbf07047b7f2
- SHA512 f202f658497277e5b1e017b6b7afa44852313903468f1bc958600046d5c7a41b8688e166db2cb4a19b2bc8269c4abd1a758327d01463f3250a44b43aaafb2b3b
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext