General
-
Target
1672-63-0x0000000004FB0000-0x0000000004FEA000-memory.dmp
-
Size
232KB
-
Sample
220930-n6scmadea5
-
MD5
c34774b1b937d4ea458760d1d4b68e0f
-
SHA1
fbb9fcead43fa3aad3e8cb7bd6fe33de1d207f4e
-
SHA256
65133303d750115447fa1929689e8cd6132509edf6a08eec75f22d9bf950b2fe
-
SHA512
c10f67e492830e4aa23bfdcef6d2dd718ac53984dd579ecaf24e03d39d4177f2ed381b8d86468fe781a55c2ef53bf1544a03d58c2afcc6443e7bfe5e97198fc8
-
SSDEEP
6144:nYh150TEMLFj87O02U9QeUmmjmJCXy7eL2j4XsFtUDc1u50vQk3Le:nY90TEMLF8ZPOfje1xvQY
Behavioral task
behavioral1
Sample
1672-63-0x0000000004FB0000-0x0000000004FEA000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1672-63-0x0000000004FB0000-0x0000000004FEA000-memory.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.lulifama.nl - Port:
587 - Username:
[email protected] - Password:
5UbPvLRka8
Targets
-
-
Target
1672-63-0x0000000004FB0000-0x0000000004FEA000-memory.dmp
-
Size
232KB
-
MD5
c34774b1b937d4ea458760d1d4b68e0f
-
SHA1
fbb9fcead43fa3aad3e8cb7bd6fe33de1d207f4e
-
SHA256
65133303d750115447fa1929689e8cd6132509edf6a08eec75f22d9bf950b2fe
-
SHA512
c10f67e492830e4aa23bfdcef6d2dd718ac53984dd579ecaf24e03d39d4177f2ed381b8d86468fe781a55c2ef53bf1544a03d58c2afcc6443e7bfe5e97198fc8
-
SSDEEP
6144:nYh150TEMLFj87O02U9QeUmmjmJCXy7eL2j4XsFtUDc1u50vQk3Le:nY90TEMLF8ZPOfje1xvQY
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-