General
-
Target
Para Transferi Bilgilendirmesi-Dekont 04.exe
-
Size
212KB
-
Sample
230401-h8elnagf63
-
MD5
0a16b273c1c87e41e6fc713cb3970b34
-
SHA1
5dceedb5d74338df57880e672789545e458c66e6
-
SHA256
0498df7766a9d0baf201351f7bd8a2914dbbfb95c8d13a514f53c894e3a47b05
-
SHA512
ddc3c43baeaed4d52e472ac23269998295424ca85da7efeec2000c4db81c73bed85cdbe21c5dd9f5befee556de7c8b58c449c9832a959f5b475a11d76e371f7c
-
SSDEEP
6144:Z7jxlU4XyaR66Rplx71yHpRIxf4v5HlI:Z7jx7trxPyoxojI
Static task
static1
Behavioral task
behavioral1
Sample
Para Transferi Bilgilendirmesi-Dekont 04.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Para Transferi Bilgilendirmesi-Dekont 04.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5947903340:AAGwrx6AH8fIoMQeBa5HDgsc3Ce_i6Zbfek/
Targets
-
-
Target
Para Transferi Bilgilendirmesi-Dekont 04.exe
-
Size
212KB
-
MD5
0a16b273c1c87e41e6fc713cb3970b34
-
SHA1
5dceedb5d74338df57880e672789545e458c66e6
-
SHA256
0498df7766a9d0baf201351f7bd8a2914dbbfb95c8d13a514f53c894e3a47b05
-
SHA512
ddc3c43baeaed4d52e472ac23269998295424ca85da7efeec2000c4db81c73bed85cdbe21c5dd9f5befee556de7c8b58c449c9832a959f5b475a11d76e371f7c
-
SSDEEP
6144:Z7jxlU4XyaR66Rplx71yHpRIxf4v5HlI:Z7jx7trxPyoxojI
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-