General
-
Target
Ödenen Faturalar_pdf.exe
-
Size
343KB
-
Sample
231204-qmnw7sbc91
-
MD5
a314f22d19163ad66481e97007d1b078
-
SHA1
4ffabae0f673f4d020e02ba77557fda518549345
-
SHA256
0f8733a1ea0d51fb40e382a7de06088c3fbb02df775d8f38332f72d42b7da062
-
SHA512
12c4428cebd80edb2ecc26ef8176626d33062cd4bcfcddbebd10422b8e5685596ad9618f7fface8b454b6f88bc0e03b26495bea953fc2475d4234f0b8c081165
-
SSDEEP
6144:mEfH/hHZFQxXHIxiUyP+8FBTV0Bg7CKKvLyTzfkZi8MecAR9ukaB2n:mEfH/lZY7L2Bg+KKDmzecAPukaB2n
Static task
static1
Behavioral task
behavioral1
Sample
Ödenen Faturalar_pdf.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Ödenen Faturalar_pdf.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
Protocol: ftp- Host:
mydevelopmentstory.com - Port:
21 - Username:
[email protected] - Password:
ENugu@042EN
Extracted
agenttesla
Protocol: ftp- Host:
ftp://mydevelopmentstory.com - Port:
21 - Username:
[email protected] - Password:
ENugu@042EN
Targets
-
-
Target
Ödenen Faturalar_pdf.exe
-
Size
343KB
-
MD5
a314f22d19163ad66481e97007d1b078
-
SHA1
4ffabae0f673f4d020e02ba77557fda518549345
-
SHA256
0f8733a1ea0d51fb40e382a7de06088c3fbb02df775d8f38332f72d42b7da062
-
SHA512
12c4428cebd80edb2ecc26ef8176626d33062cd4bcfcddbebd10422b8e5685596ad9618f7fface8b454b6f88bc0e03b26495bea953fc2475d4234f0b8c081165
-
SSDEEP
6144:mEfH/hHZFQxXHIxiUyP+8FBTV0Bg7CKKvLyTzfkZi8MecAR9ukaB2n:mEfH/lZY7L2Bg+KKDmzecAPukaB2n
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-