General
- Target alma emri.exe
- Size 543KB
- Sample200707-19fqa8h76e
- SHA256 38237edb2b507c23cf2e1fe3ca9dc2ac2da423fe5ada20705bc78f3926d839f7
- MD5 8c221569a2025334770a5d2fa9a2a345
- SHA1 3f2676b62e4e25c401ce33daf3bfd6bffc872765
- SHA512 20efd0c05d5b41aecd51b4e13b364ad79619b4eeacde7b6c61a5c50b4365b9ea514a1a98de0bedf7dbd699521156f16d78b9fc10257036f03f4fb46c9ddc3573
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
alma emri.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
alma emri.exe
Resource
win10v200430
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
chosen@@@123
Targets
-
- Target alma emri.exe
- Size 543KB
- SHA256 38237edb2b507c23cf2e1fe3ca9dc2ac2da423fe5ada20705bc78f3926d839f7
- MD5 8c221569a2025334770a5d2fa9a2a345
- SHA1 3f2676b62e4e25c401ce33daf3bfd6bffc872765
- SHA512 20efd0c05d5b41aecd51b4e13b364ad79619b4eeacde7b6c61a5c50b4365b9ea514a1a98de0bedf7dbd699521156f16d78b9fc10257036f03f4fb46c9ddc3573
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext