General
- Target 5d388a0651d6bb853ebcd267f3571c6a
- Size 842KB
- Sample211012-k3bc6acaa9
- SHA256 e6c9d7712cbb3e74662f656d5b0891c79bf175c3955fab5a791ca92e64bba8da
- MD5 5d388a0651d6bb853ebcd267f3571c6a
- SHA1 b32c0f07804238a7c588f1a8e74b56fdb08b8dfc
- SHA512 deb68aa4fa6e43e04f0d88d07249bb74a5c35caab24e02e3951cd382af34ea5661a0af99b9a8fa9efdd034fd2c787feaf35baa02d998f585fa61f31d6e6c759d
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
5d388a0651d6bb853ebcd267f3571c6a.exe
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5d388a0651d6bb853ebcd267f3571c6a.exe
Resource
win10-en-20210920
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
C2
-
https://api.telegram.org/bot1923270472:AAFHljVp-f8Q5-X0iy70Vfe0aTch5THPa-U/sendDocument
Targets
-
- Target 5d388a0651d6bb853ebcd267f3571c6a
- Size 842KB
- SHA256 e6c9d7712cbb3e74662f656d5b0891c79bf175c3955fab5a791ca92e64bba8da
- MD5 5d388a0651d6bb853ebcd267f3571c6a
- SHA1 b32c0f07804238a7c588f1a8e74b56fdb08b8dfc
- SHA512 deb68aa4fa6e43e04f0d88d07249bb74a5c35caab24e02e3951cd382af34ea5661a0af99b9a8fa9efdd034fd2c787feaf35baa02d998f585fa61f31d6e6c759d
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext