General
- Target QUOTATION#00845.exe
- Size 937KB
- Sample231121-lchj8ade68
- SHA256 8acf98103ca250e8dd4d0e507e87c51085de89a0faf2955fbc419d9354b3793a
- MD5 a4ca9bf73bf7cf96e74c37ae676ea8d1
- SHA1 75be0d32915d421344dc964c9cfb63ff3ba85d7b
- SHA512 6bf9d50412f3801787fe566299ec620313ce27ef0fa9f4653a72c39eedce7bc5065bf4dee64e216707975420e17bc55dd330f0164ff1bad466a777e2809bcd77
- SSDEEP 12288:GmEZsC5DdsAiOAvlForbAY5FuTYxTIHl+Vup1E4D0XVe7qlGb9RSiyyjK:GDTd3G8rnFUiTIKup1F0XFlGRRd8
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
QUOTATION#00845.exe
Resource
win7-20231023-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
QUOTATION#00845.exe
Resource
win10v2004-20231025-en
6 signatures
150 seconds
Malware Config
Extracted
Credentials
-
Protocol
ftp
-
Host
ftp.code-jet.com
-
Port
21
-
Username
-
Password
4+i)Wf,h^zRm
Extracted
Family
-
agenttesla
Credentials
-
Protocol
ftp
-
Host
ftp://ftp.code-jet.com
-
Port
21
-
Username
-
Password
4+i)Wf,h^zRm
Targets
-
- Target QUOTATION#00845.exe
- Size 937KB
- SHA256 8acf98103ca250e8dd4d0e507e87c51085de89a0faf2955fbc419d9354b3793a
- MD5 a4ca9bf73bf7cf96e74c37ae676ea8d1
- SHA1 75be0d32915d421344dc964c9cfb63ff3ba85d7b
- SHA512 6bf9d50412f3801787fe566299ec620313ce27ef0fa9f4653a72c39eedce7bc5065bf4dee64e216707975420e17bc55dd330f0164ff1bad466a777e2809bcd77
- SSDEEP 12288:GmEZsC5DdsAiOAvlForbAY5FuTYxTIHl+Vup1E4D0XVe7qlGb9RSiyyjK:GDTd3G8rnFUiTIKup1F0XFlGRRd8
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext