General
- Target R F Q.zip
- Size 442KB
- Sample230605-tmc2gshe34
- SHA256 fc2a6b2906434dadf264496da8cbdbfe8286f9fafcb95e44e6c23c25d116f63f
- MD5 863b1085d45f5230d8493110fd66badb
- SHA1 5c3d70f657fc890b77e0a938903486c9cacc8e20
- SHA512 49dc7ce2fa340ce6ac7b2c5005898ae47d9ed7674362aca4731981cc1953dd00ce0c7fdd15160e4d9b6ccee90eb317ed8b95dd44fe8ea5a963a64dc48137cb3c
- SSDEEP 12288:6FPJAcCi3QIPwor0Vl04dOChBNMLBEBWMULS:I25iqhVm4wMBoaMfS
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
R F Q.exe
Resource
win7-20230220-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
R F Q.exe
Resource
win10v2004-20230220-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.garagerobert.be
-
Port
587
-
Username
-
Password
dibi7779
-
Email to
Targets
-
- Target R F Q.exe
- Size 693KB
- SHA256 89aac1da79c39c6dca27fbd441600f2fc6b72e051d3e31e6c6738f4fa84698b8
- MD5 33aafdcbbee5896be71abe19e26000db
- SHA1 108a28b629bd34d8c766face9eebc01eae7dde1b
- SHA512 bbe6a96c78f81c28acb8b8e0b59f11fd44e473a046dc19a9b4b771d9ec5024fed71595785ba81311adbb894121ca6479e5dc555d6ea2fcee67e1e1034f46cfba
- SSDEEP 12288:88GJcCoz0IPwwpcFlM6xOCvjNgLsdmc1pBWMm:8n5oCDFa60wjAn6M
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext