General
- Target M4_RFQ.exe
- Size 441KB
- Sample201109-k1ee8pblcs
- SHA256 ea00e61f682dcda07a223e3812f6b87b2182a3dd9999a6872563ea709bc2d282
- MD5 57c028612ece1027ba18fe5b3e2a1b77
- SHA1 644fff2f5f812b47dca369160da53bfcadf91a64
- SHA512 9c3f9eba0e0ad8f0f2fa8d58b699c1c83cd2a09ed96d58e96476375931b7d87d8d42e5f6e81e0a35260e60954655b7e1a304a87fd3b98899dda21f543f451257
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
M4_RFQ.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
M4_RFQ.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.privateemail.com
-
Port
587
-
Username
-
Password
@damienzy.xyz2240
Targets
-
- Target M4_RFQ.exe
- Size 441KB
- SHA256 ea00e61f682dcda07a223e3812f6b87b2182a3dd9999a6872563ea709bc2d282
- MD5 57c028612ece1027ba18fe5b3e2a1b77
- SHA1 644fff2f5f812b47dca369160da53bfcadf91a64
- SHA512 9c3f9eba0e0ad8f0f2fa8d58b699c1c83cd2a09ed96d58e96476375931b7d87d8d42e5f6e81e0a35260e60954655b7e1a304a87fd3b98899dda21f543f451257
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext