General
- Target SecuriteInfo.com.Win32.PWSX-gen.30341.30028.exe
- Size 1.1MB
- Sample231026-rcplescc5x
- SHA256 474f06b633df4bd1a96c607939cca087c7326eeeea52b28d9d925f7da35d03dc
- MD5 81d0b610bfc2355b6786507ff92cc867
- SHA1 21becc44add9336caf943664b91252b21026baee
- SHA512 93604f2889626e098e3b2acf497388ef6a9dce98924e92128f132b9a6df91c40d6943ba9a043c0ae14520ef11a1359d689bffc28c38333be64ef8b495ad9486e
- SSDEEP 24576:LTt1XH8TjEXo8xChIaV53wq0Gp3/Iba+6lEJ/0d8k:3rooGpr+d/0K
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.PWSX-gen.30341.30028.exe
Resource
win7-20231023-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.PWSX-gen.30341.30028.exe
Resource
win10v2004-20231023-en
6 signatures
150 seconds
Malware Config
Extracted
Credentials
-
Protocol
ftp
-
Host
ftp.code-jet.com
-
Port
21
-
Username
-
Password
4+i)Wf,h^zRm
Extracted
Family
-
agenttesla
Credentials
-
Protocol
ftp
-
Host
ftp://ftp.code-jet.com
-
Port
21
-
Username
-
Password
4+i)Wf,h^zRm
Targets
-
- Target SecuriteInfo.com.Win32.PWSX-gen.30341.30028.exe
- Size 1.1MB
- SHA256 474f06b633df4bd1a96c607939cca087c7326eeeea52b28d9d925f7da35d03dc
- MD5 81d0b610bfc2355b6786507ff92cc867
- SHA1 21becc44add9336caf943664b91252b21026baee
- SHA512 93604f2889626e098e3b2acf497388ef6a9dce98924e92128f132b9a6df91c40d6943ba9a043c0ae14520ef11a1359d689bffc28c38333be64ef8b495ad9486e
- SSDEEP 24576:LTt1XH8TjEXo8xChIaV53wq0Gp3/Iba+6lEJ/0d8k:3rooGpr+d/0K
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext