General
-
Target
1687f070199786f150f1dd9330c2297ff52ff3e08103e0f4213424281e6968b8
-
Size
553KB
-
Sample
231206-t6zplafa3s
-
MD5
5d15bf6ba03e0c7bd5821382f5537e9a
-
SHA1
ef2fcd77af9bf07b8ed6b6d5bf9414788a7deb3a
-
SHA256
1687f070199786f150f1dd9330c2297ff52ff3e08103e0f4213424281e6968b8
-
SHA512
6e9f3c001124ff75c092ccaffc4b27266e36e4338515ccd2d6ceb5ffa7f2de619ec636ca2907ad1d5746fda4b02b56e70c10ff4425d38153e6cd81beeac5e331
-
SSDEEP
12288:7b7gT4EzMu430AxurhvmvcofOPM5TvA1DornG4GVkMU+0HS7BQqnvgrqy:7w4EzC0lYcoWPeys6nPOy7tnE/
Static task
static1
Behavioral task
behavioral1
Sample
MT094673828393_____________JPG.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
MT094673828393_____________JPG.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.worlorderbillions.top - Port:
587 - Username:
[email protected] - Password:
tank576$%)&** - Email To:
[email protected]
Targets
-
-
Target
MT094673828393_____________JPG.bat
-
Size
620KB
-
MD5
dcec0273a4b0e8147f47a7e130a3ec3c
-
SHA1
044711055b8e2ee9a6b0b53a022739181ec89bc6
-
SHA256
85402287b6fe22e1af79bc5410c6e8faf98386e5a2e419744c5a594cc5dfcbcd
-
SHA512
8338f2049b95a2cae24b66297276897fff83802137269a3fdbd1aebe652aebf0e7074dc63c02ec6045c8f445b99ad4fd1fb4d1fed9ea85b2369c44a170a57433
-
SSDEEP
12288:gTueH5qMi30cqAacofOPMHTvA1PiuTh4B4q5Rg+Kys3:4qV0aacoWPmyPi4SXT
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-