General
-
Target
a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92
-
Size
632KB
-
Sample
231205-t8gxkacd61
-
MD5
bdf17bc9572ea9688f7197170c9e8ba5
-
SHA1
51b46673afb0cc49ef3159c2f6b026832b4ceeef
-
SHA256
a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92
-
SHA512
42217e461b74b96805b8a0cfb4733dca210485dfdc6f44bf578ccd50d16ced83e2a0ba0bda3426671b51368d9508f7fa397653c5db4881cf76adcc39566f82eb
-
SSDEEP
12288:645+po2mrMbymdO0XIgEPtYz5w62FEASUjJq4tiNF/3M3Guc817:Z+pJrrdO04gwtYz5wrF4UjY48NF/Tuc8
Static task
static1
Behavioral task
behavioral1
Sample
a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mersinanneleriyasamdernegi.com - Port:
587 - Username:
[email protected] - Password:
8BDMrcLAz+uv - Email To:
[email protected]
Targets
-
-
Target
a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92
-
Size
632KB
-
MD5
bdf17bc9572ea9688f7197170c9e8ba5
-
SHA1
51b46673afb0cc49ef3159c2f6b026832b4ceeef
-
SHA256
a79b1f114580faa92faeb2e6bcd6dea0dfa24f28abdacb227f18cd4b16a27a92
-
SHA512
42217e461b74b96805b8a0cfb4733dca210485dfdc6f44bf578ccd50d16ced83e2a0ba0bda3426671b51368d9508f7fa397653c5db4881cf76adcc39566f82eb
-
SSDEEP
12288:645+po2mrMbymdO0XIgEPtYz5w62FEASUjJq4tiNF/3M3Guc817:Z+pJrrdO04gwtYz5wrF4UjY48NF/Tuc8
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-