General
- Target COMPANY DOCUMENTS.exe
- Size 770KB
- Sample210609-2pg3ekq28a
- SHA256 23256fd1a2baa8972ee58af4aeff4ef3dc9fc095086430982f0e27f72c7fffee
- MD5 3c972d9b4036fc45c55aa15004c92bc5
- SHA1 fcb9fd56f0210a0198cd044a3a1a2d443567a085
- SHA512 36960bcef6c7e89b3c987f917f866ebdc38d1d75cb72851d219cc1151019b089ea3699fb8e772bb50d873aa28838114e1d891c1c9eb1f11fd6bbe2551609071b
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
COMPANY DOCUMENTS.exe
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
COMPANY DOCUMENTS.exe
Resource
win10v20210410
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
us2.smtp.mailhostbox.com
-
Port
587
-
Username
-
Password
08102186737CEO
Targets
-
- Target COMPANY DOCUMENTS.exe
- Size 770KB
- SHA256 23256fd1a2baa8972ee58af4aeff4ef3dc9fc095086430982f0e27f72c7fffee
- MD5 3c972d9b4036fc45c55aa15004c92bc5
- SHA1 fcb9fd56f0210a0198cd044a3a1a2d443567a085
- SHA512 36960bcef6c7e89b3c987f917f866ebdc38d1d75cb72851d219cc1151019b089ea3699fb8e772bb50d873aa28838114e1d891c1c9eb1f11fd6bbe2551609071b
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext