General
-
Target
Hesaphareketi-01.exe
-
Size
793KB
-
Sample
231201-hjbhpsfe82
-
MD5
3afe7ac331aba60b1748358613d16b52
-
SHA1
2e5f92b77c23ef602642ce6df48305e7fa45e896
-
SHA256
a59437567cef6624a191e8b8b4f94b72e056e896ba28d15cd466cb36b5f186a1
-
SHA512
5d46e710f8d45e36cc0c791454a977339e5af6102669bab178c598a15b580badf2d243b5dee799ff75f2bd0935b4cb63c08ec353eec4c62c1b0629e7048ef718
-
SSDEEP
24576:V91tD/Y2IZVROhxbOuIx3ISaJ5K1xQl5qHyje:VFY2ZCuIxkHL/qHyj
Static task
static1
Behavioral task
behavioral1
Sample
Hesaphareketi-01.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Hesaphareketi-01.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.defalife.com.tr - Port:
587 - Username:
[email protected] - Password:
Defalife.124578 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.defalife.com.tr - Port:
587 - Username:
[email protected] - Password:
Defalife.124578
Targets
-
-
Target
Hesaphareketi-01.exe
-
Size
793KB
-
MD5
3afe7ac331aba60b1748358613d16b52
-
SHA1
2e5f92b77c23ef602642ce6df48305e7fa45e896
-
SHA256
a59437567cef6624a191e8b8b4f94b72e056e896ba28d15cd466cb36b5f186a1
-
SHA512
5d46e710f8d45e36cc0c791454a977339e5af6102669bab178c598a15b580badf2d243b5dee799ff75f2bd0935b4cb63c08ec353eec4c62c1b0629e7048ef718
-
SSDEEP
24576:V91tD/Y2IZVROhxbOuIx3ISaJ5K1xQl5qHyje:VFY2ZCuIxkHL/qHyj
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-