General
-
Target
3baa78c22e5bd5e133c4c434344bb56389c5243fda9a6e97a716611f85871fa5
-
Size
793KB
-
Sample
221125-sjlnsafd79
-
MD5
93b60c04445b04883b154e9cfd45bc5e
-
SHA1
954271bef99a382fa30eb009bc93992042457f84
-
SHA256
3baa78c22e5bd5e133c4c434344bb56389c5243fda9a6e97a716611f85871fa5
-
SHA512
0b9efab4746b14bd7bad0b80f7ed340e306d820cf8cfa0afa04e4b8b15626e0768bf30f51dbedec0390af809d6c66df6a318a003eac99d056bd4b630e6b5403f
-
SSDEEP
6144:3T9xO8zztdIikXxz4WfN9oVn6neiiTKoEqc7f3ltHTvdAVgjsOS2j/rUa/v3S1NF:3hxh+1uIvltHbdAVSsOS2j/rL/v3eN
Static task
static1
Behavioral task
behavioral1
Sample
3baa78c22e5bd5e133c4c434344bb56389c5243fda9a6e97a716611f85871fa5.exe
Resource
win10-20220812-en
Malware Config
Extracted
Protocol: smtp- Host:
smtp.leonardfood.com - Port:
587 - Username:
[email protected] - Password:
K@rimi95
Extracted
agenttesla
Protocol: smtp- Host:
smtp.leonardfood.com - Port:
587 - Username:
[email protected] - Password:
K@rimi95 - Email To:
[email protected]
Targets
-
-
Target
3baa78c22e5bd5e133c4c434344bb56389c5243fda9a6e97a716611f85871fa5
-
Size
793KB
-
MD5
93b60c04445b04883b154e9cfd45bc5e
-
SHA1
954271bef99a382fa30eb009bc93992042457f84
-
SHA256
3baa78c22e5bd5e133c4c434344bb56389c5243fda9a6e97a716611f85871fa5
-
SHA512
0b9efab4746b14bd7bad0b80f7ed340e306d820cf8cfa0afa04e4b8b15626e0768bf30f51dbedec0390af809d6c66df6a318a003eac99d056bd4b630e6b5403f
-
SSDEEP
6144:3T9xO8zztdIikXxz4WfN9oVn6neiiTKoEqc7f3ltHTvdAVgjsOS2j/rUa/v3S1NF:3hxh+1uIvltHbdAVSsOS2j/rL/v3eN
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-