General
-
Target
3c6b3c50afec4a49e616569559d4a749.exe
-
Size
689KB
-
Sample
231203-ve4d5sdb93
-
MD5
3c6b3c50afec4a49e616569559d4a749
-
SHA1
9f5844d3f48eee948e371d4f527b4459b3323f73
-
SHA256
18ff7446c538ea6c96f148a12b2a214f9823d7e4061c2f3d350cd81e6a8de8c5
-
SHA512
4f12fee3499145d457058690ab7c4ec280d7fea46eb5113dc3e970b3efc3f3e0637a6e227e6917672c62a6615fed016235c92b5b8135d1021660fa1b33055765
-
SSDEEP
12288:wq8o4AJwATF0VN+B+xMuWIatYJrcAlZS/XJjxAl/LLOEiYFtY:UIhTF0VxMqJXMXJNAlDLO8FG
Static task
static1
Behavioral task
behavioral1
Sample
3c6b3c50afec4a49e616569559d4a749.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
3c6b3c50afec4a49e616569559d4a749.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.worlorderbillions.top - Port:
587 - Username:
[email protected] - Password:
Zcj,hK*0y{mA - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.worlorderbillions.top - Port:
587 - Username:
[email protected] - Password:
Zcj,hK*0y{mA
Targets
-
-
Target
3c6b3c50afec4a49e616569559d4a749.exe
-
Size
689KB
-
MD5
3c6b3c50afec4a49e616569559d4a749
-
SHA1
9f5844d3f48eee948e371d4f527b4459b3323f73
-
SHA256
18ff7446c538ea6c96f148a12b2a214f9823d7e4061c2f3d350cd81e6a8de8c5
-
SHA512
4f12fee3499145d457058690ab7c4ec280d7fea46eb5113dc3e970b3efc3f3e0637a6e227e6917672c62a6615fed016235c92b5b8135d1021660fa1b33055765
-
SSDEEP
12288:wq8o4AJwATF0VN+B+xMuWIatYJrcAlZS/XJjxAl/LLOEiYFtY:UIhTF0VxMqJXMXJNAlDLO8FG
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-