General
-
Target
535d20566edc74781d8e3bdb0323e524745ad0c58944b74ca20f8710999ada25
-
Size
901KB
-
Sample
231127-l4fvpsfg9s
-
MD5
9a03789a00221391cee7208ae1b55679
-
SHA1
9cbf3496c32fc65bf9dfd6e1fc5197cbc0186c1e
-
SHA256
535d20566edc74781d8e3bdb0323e524745ad0c58944b74ca20f8710999ada25
-
SHA512
6b6d4bd073ad9c2f900bd99dae1866c52358e92426f62948b55a7f053bba8879c4e7819c23b94acced7ad6b1688dadcea4608a7084bcb91cc69316954d393e77
-
SSDEEP
24576:vgxojP5yrQFckqW8Yg4e+/Ujux5dXr2tr7tkNBbCp:IxojP5U4dqlXQ/X4t3p
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
urpnvucvmhffkuvu - Email To:
[email protected]
Targets
-
-
Target
PO OAU_NOVQTRFA00541·PDF.scr
-
Size
2.4MB
-
MD5
03a1eceb4cbfd2f657e9bd6e9d936290
-
SHA1
5290a8530a4254f3ede7262fed88b0b3bdbb16eb
-
SHA256
268c6adab2d20b3c821fec7ecfdaf72fbe267d07f0e3da839626e67addfdffef
-
SHA512
7705e3765d5c38c243543362e02d9d70dda42b46e1b39f834ca31553adf852e9243b99394a4d45ef7514afebba5983106bf1c29614f72209f55ccde47f144856
-
SSDEEP
49152:9KeZGjstCh12D9oN8ZJBZ1PVrpujFDj9WK0PuAHz9Iy:9KeZqFh12pW0ZHz9I
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-