General
- Target 1L62NY9ZQMprumk.exe
- Size 667KB
- Sample240411-jbs88aef72
- SHA256 888714e20e0e1ea31a87ed8e975ea7dae65744d65870a52336146f40b2b07433
- MD5 ae7e54f55f6e95d58a3d93e879106e62
- SHA1 b74ddaa43e3e0d3d5a004ec17ddcfa3469e6c63b
- SHA512 9931541d4b0b7cad262fdf6f175d7f02107b1508b3fd82dd54deae157c10b47b1c2b5616708978a08238e266549ce6a7d094244f96b1a251685a4dd418cf671c
- SSDEEP 12288:Z8P6RtKY7QS6OCwVOWoldEsM3puQbVWvXfrNcAvnvgcKsWWT:Z/QS6OCHXnEsM+JcAvnvYsWW
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1L62NY9ZQMprumk.exe
Resource
win7-20240319-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
1L62NY9ZQMprumk.exe
Resource
win10v2004-20240226-en
5 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.expatmedical.ro
-
Port
587
-
Username
-
Password
Alex2009
-
Email to
Targets
-
- Target 1L62NY9ZQMprumk.exe
- Size 667KB
- SHA256 888714e20e0e1ea31a87ed8e975ea7dae65744d65870a52336146f40b2b07433
- MD5 ae7e54f55f6e95d58a3d93e879106e62
- SHA1 b74ddaa43e3e0d3d5a004ec17ddcfa3469e6c63b
- SHA512 9931541d4b0b7cad262fdf6f175d7f02107b1508b3fd82dd54deae157c10b47b1c2b5616708978a08238e266549ce6a7d094244f96b1a251685a4dd418cf671c
- SSDEEP 12288:Z8P6RtKY7QS6OCwVOWoldEsM3puQbVWvXfrNcAvnvgcKsWWT:Z/QS6OCHXnEsM+JcAvnvYsWW
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext