General
-
Target
Hesap hareketleriniz.exe
-
Size
657KB
-
Sample
230330-wcv6esfa9x
-
MD5
5e165a00cd809f7605073d7c40eabc8d
-
SHA1
7d473fb5e61d0cfbbd168c88b8f9a85e83a0a125
-
SHA256
6869aea56b539fe8189237aeff9f338691b034ebbfce1688e0f05e080dc9fb7a
-
SHA512
69848cc7729ee9b763dfbeaae3dbd50bd944c7c0690f3e66be6c942bf5f9751b90c46e950db6c27ad0d31e685a7acf6a21494e42797be44ca8236419ec70feb8
-
SSDEEP
12288:SvCgELbEubK0iEvLnfZka63QGX12G8/CfRXzlmqdTrtp2oimOMt+5:STOG0iQnfn6AGX4PCflzQyttimXi
Static task
static1
Behavioral task
behavioral1
Sample
Hesap hareketleriniz.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Hesap hareketleriniz.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.servicesterminals.com - Port:
587 - Username:
kenneth@servicesterminals.com - Password:
zK2kveho - Email To:
kenneth@servicesterminals.com
Targets
-
-
Target
Hesap hareketleriniz.exe
-
Size
657KB
-
MD5
5e165a00cd809f7605073d7c40eabc8d
-
SHA1
7d473fb5e61d0cfbbd168c88b8f9a85e83a0a125
-
SHA256
6869aea56b539fe8189237aeff9f338691b034ebbfce1688e0f05e080dc9fb7a
-
SHA512
69848cc7729ee9b763dfbeaae3dbd50bd944c7c0690f3e66be6c942bf5f9751b90c46e950db6c27ad0d31e685a7acf6a21494e42797be44ca8236419ec70feb8
-
SSDEEP
12288:SvCgELbEubK0iEvLnfZka63QGX12G8/CfRXzlmqdTrtp2oimOMt+5:STOG0iQnfn6AGX4PCflzQyttimXi
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-