General
- Target rJlMhHdHP2mDzMGx.exe
- Size 1001KB
- Sample240419-vvtvmsbb8t
- SHA256 74caca096964cc34ef4132f16a9a0aaa96b2d2a5972ee3c7c55bd5634c88bd70
- MD5 aa9057494eca3828c4aaca40ec9d823e
- SHA1 d40deb9f879f6c5ff7bd8597d95f6c6592861a60
- SHA512 ba6d8bb4288e7f3c18c22c58fda0151f5674502c1ff4a19d658eea25ac03404e8ea9805db6446b3d5f806c58b4a46f6a9037b7f3fcda5f26e54815b2b3ece52f
- SSDEEP 12288:AhTSy6oFOimegps2Z/FQue7TzPFHKoQjRMecE1Qw31mvlhCtmrZ64991tNGaOVCL:sLh3YvS9PooQqDE1BFmDZ591lYCL
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
rJlMhHdHP2mDzMGx.exe
Resource
win7-20240215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
rJlMhHdHP2mDzMGx.exe
Resource
win10v2004-20240412-en
5 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.gazityres.com
-
Port
587
-
Username
-
Password
Gazi1975
-
Email to
Targets
-
- Target rJlMhHdHP2mDzMGx.exe
- Size 1001KB
- SHA256 74caca096964cc34ef4132f16a9a0aaa96b2d2a5972ee3c7c55bd5634c88bd70
- MD5 aa9057494eca3828c4aaca40ec9d823e
- SHA1 d40deb9f879f6c5ff7bd8597d95f6c6592861a60
- SHA512 ba6d8bb4288e7f3c18c22c58fda0151f5674502c1ff4a19d658eea25ac03404e8ea9805db6446b3d5f806c58b4a46f6a9037b7f3fcda5f26e54815b2b3ece52f
- SSDEEP 12288:AhTSy6oFOimegps2Z/FQue7TzPFHKoQjRMecE1Qw31mvlhCtmrZ64991tNGaOVCL:sLh3YvS9PooQqDE1BFmDZ591lYCL
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext