General
-
Target
7a7ff26b66d38cc6f04b3c37f6531a0ad742a1547b7bb8f13fe0f01abea834e5
-
Size
725KB
-
Sample
231201-ksww4sgc92
-
MD5
ce71f6f91733f2be9c884f7b3416bfaf
-
SHA1
0a2ad751d656b7cbb7980ca7006bb651cb9e8c92
-
SHA256
7a7ff26b66d38cc6f04b3c37f6531a0ad742a1547b7bb8f13fe0f01abea834e5
-
SHA512
5e280d523cdd2e8d7b563f590d626073ebb194e84ba089f0638daea86fe7e9df51af9263fde1d00bdb5820a3b08f825dccd1f3444360661151a980c70893606c
-
SSDEEP
12288:pbdINmOTqKDENQcbMCVkmJvEIeeGBux7ANI/LhhyD+B/P8m9:F2NTqmgbM8xfeeG/NI/Lhhy+XB
Static task
static1
Behavioral task
behavioral1
Sample
7a7ff26b66d38cc6f04b3c37f6531a0ad742a1547b7bb8f13fe0f01abea834e5.exe
Resource
win10-20231023-en
Malware Config
Extracted
Protocol: smtp- Host:
cp5ua.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$
Extracted
agenttesla
Protocol: smtp- Host:
cp5ua.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$ - Email To:
[email protected]
Targets
-
-
Target
7a7ff26b66d38cc6f04b3c37f6531a0ad742a1547b7bb8f13fe0f01abea834e5
-
Size
725KB
-
MD5
ce71f6f91733f2be9c884f7b3416bfaf
-
SHA1
0a2ad751d656b7cbb7980ca7006bb651cb9e8c92
-
SHA256
7a7ff26b66d38cc6f04b3c37f6531a0ad742a1547b7bb8f13fe0f01abea834e5
-
SHA512
5e280d523cdd2e8d7b563f590d626073ebb194e84ba089f0638daea86fe7e9df51af9263fde1d00bdb5820a3b08f825dccd1f3444360661151a980c70893606c
-
SSDEEP
12288:pbdINmOTqKDENQcbMCVkmJvEIeeGBux7ANI/LhhyD+B/P8m9:F2NTqmgbM8xfeeG/NI/Lhhy+XB
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-