General
- Target Quotation.exe
- Size 431KB
- Sample200708-zzkc47mcr2
- SHA256 4e4f9a06f2544bb63460caaf2aeb35875d71c2c644060a12b8bb28bbf878eb61
- MD5 deceda9833ced5d4a565385fd60ce0aa
- SHA1 29f9ae1c605d753e1ffcd156b17d4907849f8079
- SHA512 411e9b584e9be4c8ad0a70c9cb613925ce3fb5ddc45ae31ea09adff919b983b1237b461fe12465081850eb83810d3539b98a6c3641c197787bf837807d9081f3
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10v200430
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.mexicanproduct.com.mx
-
Port
587
-
Username
-
Password
Produccion2020.
Targets
-
- Target Quotation.exe
- Size 431KB
- SHA256 4e4f9a06f2544bb63460caaf2aeb35875d71c2c644060a12b8bb28bbf878eb61
- MD5 deceda9833ced5d4a565385fd60ce0aa
- SHA1 29f9ae1c605d753e1ffcd156b17d4907849f8079
- SHA512 411e9b584e9be4c8ad0a70c9cb613925ce3fb5ddc45ae31ea09adff919b983b1237b461fe12465081850eb83810d3539b98a6c3641c197787bf837807d9081f3
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext