General
-
Target
09326d84d6ba7c8bfcc5c96d1d30f82179ec627d2936dc39e9e296872ca272aa.exe
-
Size
614KB
-
Sample
231201-vnqjmsdh8x
-
MD5
09e588de05f6b854dbfdeb5fbce76b46
-
SHA1
597fc40270626e1beb9227ad67690b7174817d60
-
SHA256
09326d84d6ba7c8bfcc5c96d1d30f82179ec627d2936dc39e9e296872ca272aa
-
SHA512
af772251b347549fe3f0489ae5d9e6befb9a2759a90a04efcbd5d387f707b98300731936f15845f6e8dcdd1dda5c7f57f60677b3381809c3a07d34c01c746d66
-
SSDEEP
12288:qqfLYYZXTyRqUydPmJbVJcaO+kATXHrJv/wPC7rHUn7w7Q6ykw8877UMAysP2E4J:ZXTlOJ9TTx/vHg7w7Q6ykw8877X/m
Static task
static1
Behavioral task
behavioral1
Sample
09326d84d6ba7c8bfcc5c96d1d30f82179ec627d2936dc39e9e296872ca272aa.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
09326d84d6ba7c8bfcc5c96d1d30f82179ec627d2936dc39e9e296872ca272aa.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.practienvases.com.mx - Port:
587 - Username:
[email protected] - Password:
CliEn395Tes.8 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.practienvases.com.mx - Port:
587 - Username:
[email protected] - Password:
CliEn395Tes.8
Targets
-
-
Target
09326d84d6ba7c8bfcc5c96d1d30f82179ec627d2936dc39e9e296872ca272aa.exe
-
Size
614KB
-
MD5
09e588de05f6b854dbfdeb5fbce76b46
-
SHA1
597fc40270626e1beb9227ad67690b7174817d60
-
SHA256
09326d84d6ba7c8bfcc5c96d1d30f82179ec627d2936dc39e9e296872ca272aa
-
SHA512
af772251b347549fe3f0489ae5d9e6befb9a2759a90a04efcbd5d387f707b98300731936f15845f6e8dcdd1dda5c7f57f60677b3381809c3a07d34c01c746d66
-
SSDEEP
12288:qqfLYYZXTyRqUydPmJbVJcaO+kATXHrJv/wPC7rHUn7w7Q6ykw8877UMAysP2E4J:ZXTlOJ9TTx/vHg7w7Q6ykw8877X/m
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-