General
-
Target
155c8494c3c49df73c4957aeb657edd7
-
Size
702KB
-
Sample
231230-l5na6seccq
-
MD5
155c8494c3c49df73c4957aeb657edd7
-
SHA1
dba72cac37316896290b0b6d207c7008bf4f060b
-
SHA256
1eb33051e213067991c66d58cef9119f7fb4af31de3142db8c794b245e5d9b4a
-
SHA512
d24d89f84e17be7aff1fd9aa2c641635f4590e43bf8dda817a197a13f867a082675deed1b21d16c412a1f7b12a211bdf9b1b41ddcb0b4a41ac72029d060a5984
-
SSDEEP
12288:RvTpoZoNlkajDPK98FVouyw7Vfw+4t8r3eMtylRSpV2H12sntI:R7GZA9Pu88dAVfhj3eMQcpV2J
Static task
static1
Behavioral task
behavioral1
Sample
155c8494c3c49df73c4957aeb657edd7.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
155c8494c3c49df73c4957aeb657edd7.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.ministryofcustomsandtrade.org - Port:
587 - Username:
[email protected] - Password:
(BOsXLn2
Targets
-
-
Target
155c8494c3c49df73c4957aeb657edd7
-
Size
702KB
-
MD5
155c8494c3c49df73c4957aeb657edd7
-
SHA1
dba72cac37316896290b0b6d207c7008bf4f060b
-
SHA256
1eb33051e213067991c66d58cef9119f7fb4af31de3142db8c794b245e5d9b4a
-
SHA512
d24d89f84e17be7aff1fd9aa2c641635f4590e43bf8dda817a197a13f867a082675deed1b21d16c412a1f7b12a211bdf9b1b41ddcb0b4a41ac72029d060a5984
-
SSDEEP
12288:RvTpoZoNlkajDPK98FVouyw7Vfw+4t8r3eMtylRSpV2H12sntI:R7GZA9Pu88dAVfhj3eMQcpV2J
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Suspicious use of SetThreadContext
-