General
-
Target
Hesaphareketi-0.exe
-
Size
792KB
-
Sample
231201-hjv74sfg21
-
MD5
5cd7722aadafdc8813169f79fe26cd15
-
SHA1
a6eb9a2e6333bbcfce98d68764467e1c82b1d093
-
SHA256
725c43344564a051e58bc34bc3d2d54df05a2eb8edf522be7f0eba70087d3094
-
SHA512
98bd21cc932dc37f1fc71c8155c19c9c06eaf19cde32a8b0d9855249791bf2493aec95f5925f3c6b402f30e707689cb8e5bfa6540601c5072cf1583b808e985e
-
SSDEEP
12288:dhm1E6jD/paxJVZJToapvT/8uJ+nW9Kja0JTDYEy7P3ATsNcrZXY+opoxx:3m1tD/paxJNfvTUK+nagbmyZ/e
Static task
static1
Behavioral task
behavioral1
Sample
Hesaphareketi-0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
Hesaphareketi-0.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.defalife.com.tr - Port:
587 - Username:
[email protected] - Password:
Defalife.124578 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.defalife.com.tr - Port:
587 - Username:
[email protected] - Password:
Defalife.124578
Targets
-
-
Target
Hesaphareketi-0.exe
-
Size
792KB
-
MD5
5cd7722aadafdc8813169f79fe26cd15
-
SHA1
a6eb9a2e6333bbcfce98d68764467e1c82b1d093
-
SHA256
725c43344564a051e58bc34bc3d2d54df05a2eb8edf522be7f0eba70087d3094
-
SHA512
98bd21cc932dc37f1fc71c8155c19c9c06eaf19cde32a8b0d9855249791bf2493aec95f5925f3c6b402f30e707689cb8e5bfa6540601c5072cf1583b808e985e
-
SSDEEP
12288:dhm1E6jD/paxJVZJToapvT/8uJ+nW9Kja0JTDYEy7P3ATsNcrZXY+opoxx:3m1tD/paxJNfvTUK+nagbmyZ/e
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-