General
- Target RFQ INQUIRY.exe
- Size 1.2MB
- Sample200716-cqhs2e5m9a
- SHA256 a6fa25fe8cd37b0984480407a12b15aca056a8ca3d182c8411cf73e3e3ccdf4e
- MD5 245d677bbdcf53055d029ea71ba27e11
- SHA1 446d7e3f995e5a5338d064a4e49b86d4bd32b6b1
- SHA512 5bc5b5b361da7228cf70cb435d7a1956918ff12c2066047fd531a9811e4b30b75b1586c9adf140e61bf29bdb8b806f6632f35beff2a9641f7652fbd2d5fc3cd0
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
RFQ INQUIRY.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
RFQ INQUIRY.exe
Resource
win10v200430
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.karcek.com.tr
-
Port
587
-
Username
-
Password
Ahmet.6193
Extracted
Credentials
-
Protocol
smtp
-
Host
mail.karcek.com.tr
-
Port
587
-
Username
-
Password
Ahmet.6193
Targets
-
- Target RFQ INQUIRY.exe
- Size 1.2MB
- SHA256 a6fa25fe8cd37b0984480407a12b15aca056a8ca3d182c8411cf73e3e3ccdf4e
- MD5 245d677bbdcf53055d029ea71ba27e11
- SHA1 446d7e3f995e5a5338d064a4e49b86d4bd32b6b1
- SHA512 5bc5b5b361da7228cf70cb435d7a1956918ff12c2066047fd531a9811e4b30b75b1586c9adf140e61bf29bdb8b806f6632f35beff2a9641f7652fbd2d5fc3cd0
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext