General
-
Target
7d9216d1682b03cbc334625141e2a512.bin
-
Size
721KB
-
Sample
230328-caldnaac2t
-
MD5
e4e41ce9f45131c49973abbb1e0e0f6a
-
SHA1
59990a5aacb2cdd2d140424c0fcfaeba19500cc3
-
SHA256
af37f13c11ad1e8b810381cbbe5d4f854e19d305d54acfa6f5f2a4880b514bb9
-
SHA512
6739f546fb483cc48f4ac70307fb09000452196e84599e80fb3d490d0994ab55a33cee8360c223b2e4cb0206cf21ab071c58586bcd5b6bcaaeb14babc18a187d
-
SSDEEP
12288:9FzvjXSakg39Rzr6qspK3DJXRcPAH3fdaJCWoDOhlRupTZHKIwdb9XTUHsMjgE:9FzbXjNapKnoe31aJ/ThP99XTUHaE
Static task
static1
Behavioral task
behavioral1
Sample
f4e535a66881a91014aa12b837175eb110849a0d387a925444576387aafd633b.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f4e535a66881a91014aa12b837175eb110849a0d387a925444576387aafd633b.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.user-tech.com - Port:
587 - Username:
ordsupp@user-tech.com - Password:
Asu$7531 - Email To:
ordsupp@user-tech.com
Targets
-
-
Target
f4e535a66881a91014aa12b837175eb110849a0d387a925444576387aafd633b.bin
-
Size
802KB
-
MD5
7d9216d1682b03cbc334625141e2a512
-
SHA1
b516d984e819dc86eb94e96560f7999d01d0f8b0
-
SHA256
f4e535a66881a91014aa12b837175eb110849a0d387a925444576387aafd633b
-
SHA512
4036cf37bd22fd98d24b7e65e456a920ee1458b649e6c7409a68634c8484b87ac4166330976b41620a1ca2c701e8b9919f168695b763da650792a0e37100da3a
-
SSDEEP
12288:PUJB0O6JhZGsIpdg6AkkUNtzwjwnIGE22JbZRQRiB0iZnsn0p:ECDKs6AkkqRw8IhZR8isn0p
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-