General
- Target RFQ-May Project-6217 CK.exe
- Size 421KB
- Sample201109-mcceganmqx
- SHA256 75ef91b36f46cb8875ffaa6af3cb7f38f8689ee9c16e50f9af87966a2648962f
- MD5 73f62e274a1ca83359a980d1fdb5ba01
- SHA1 279ddfc2e6e68aec5ca31c3c55af72573aed7632
- SHA512 1ed4657024bc153a00729a3abb7050c57bf0d5056aa8a5d673984eb15311e48f6b8d6935f673cba17881e5913610a46127d3b3b00031628d27083fb8e881ad70
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-May Project-6217 CK.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
RFQ-May Project-6217 CK.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.privateemail.com
-
Port
587
-
Username
-
Password
@kingmezz.xyz
Targets
-
- Target RFQ-May Project-6217 CK.exe
- Size 421KB
- SHA256 75ef91b36f46cb8875ffaa6af3cb7f38f8689ee9c16e50f9af87966a2648962f
- MD5 73f62e274a1ca83359a980d1fdb5ba01
- SHA1 279ddfc2e6e68aec5ca31c3c55af72573aed7632
- SHA512 1ed4657024bc153a00729a3abb7050c57bf0d5056aa8a5d673984eb15311e48f6b8d6935f673cba17881e5913610a46127d3b3b00031628d27083fb8e881ad70
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops startup file
-
Suspicious use of SetThreadContext