General
-
Target
31973278e42bbfbffe3cd85a38276c4c4a6870c56828e45c5a828fe575c08775
-
Size
612KB
-
Sample
231124-jxp4pagg22
-
MD5
cd295a5fafe883073dc2819cc6565a77
-
SHA1
03ceb861829c1da7ebabd0c4a6592254b1f1ae93
-
SHA256
31973278e42bbfbffe3cd85a38276c4c4a6870c56828e45c5a828fe575c08775
-
SHA512
80d88777f09266e9908e11e44ee2dafe78f97d65731d04d6cc65049353c86870e43ad9c0c367c5562b7f1ca9c7516d389d133431bd78ab71b73cd4a4eb26f149
-
SSDEEP
12288:jvtpQyfiBpsJViA3ymsYv8kRXxVcAbZRfPi1FKm:btuyfiaoWsYkkR3Pq1Em
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
sgohuypjasozryng - Email To:
[email protected]
Targets
-
-
Target
ORDER LIST_NOVQTRFA00541·PDF.scr
-
Size
1.6MB
-
MD5
74e08a10e8e9adce66942aedf70907b4
-
SHA1
7734415270ab9d9c4d406ea953b3f88ed8daae2a
-
SHA256
d38f8cf2b6bb9ef5b9bafdc0a999d0c59c58eebad06bdd252fd2007e9701fe76
-
SHA512
0bcc851a677932773ca6922cee9836152e264461bd12979b05a2692566100fd4a883622b26671469a1b27bf1912b69fc12bafc53fa8fbcf44bbe7f69941df9aa
-
SSDEEP
49152:CQCsQ2u2UOGOgfagvVI+ze63xnZFCuT3T:Cm+zVh3Tj
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-