General
- Target 6a1e8434c7f2f2be853359a852e9b95ca50eb96466fdd404abfe4cf5c71994ee
- Size 873KB
- Sample240614-ch2evavflk
- SHA256 6a1e8434c7f2f2be853359a852e9b95ca50eb96466fdd404abfe4cf5c71994ee
- MD5 27daf6bd3782fc9d141883c391c0cdb1
- SHA1 9ef7de87f2bd5aa7ab8445d8d9d015a0dc0056a2
- SHA512 6f3ca54e647e23e0b1ec9ff4eacc3927d35da6469d14097601392454239310ecaf1b9f39c423fa2be5ee770d7b98ba504fd0907c71dbc930a0d07c7baa626ee4
- SSDEEP 12288:WiMPj4yCK2xrOoS2H7ySHlEHCoXUqh08Lb71WkvzbvECwWfF4GxXXyUcuDoD:9+syC5S2GSFoh083735wo4Gxny/uDoD
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6a1e8434c7f2f2be853359a852e9b95ca50eb96466fdd404abfe4cf5c71994ee.exe
Resource
win7-20240508-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
6a1e8434c7f2f2be853359a852e9b95ca50eb96466fdd404abfe4cf5c71994ee.exe
Resource
win10v2004-20240508-en
5 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
emidco.com
-
Port
587
-
Username
-
Password
DMmpPxx9c
-
Email to
Targets
-
- Target 6a1e8434c7f2f2be853359a852e9b95ca50eb96466fdd404abfe4cf5c71994ee
- Size 873KB
- SHA256 6a1e8434c7f2f2be853359a852e9b95ca50eb96466fdd404abfe4cf5c71994ee
- MD5 27daf6bd3782fc9d141883c391c0cdb1
- SHA1 9ef7de87f2bd5aa7ab8445d8d9d015a0dc0056a2
- SHA512 6f3ca54e647e23e0b1ec9ff4eacc3927d35da6469d14097601392454239310ecaf1b9f39c423fa2be5ee770d7b98ba504fd0907c71dbc930a0d07c7baa626ee4
- SSDEEP 12288:WiMPj4yCK2xrOoS2H7ySHlEHCoXUqh08Lb71WkvzbvECwWfF4GxXXyUcuDoD:9+syC5S2GSFoh083735wo4Gxny/uDoD
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext