General
-
Target
4903ed7c47795ecf3e4b45617f02b0a4.exe
-
Size
951KB
-
Sample
240107-ycxqcsdfe4
-
MD5
4903ed7c47795ecf3e4b45617f02b0a4
-
SHA1
60d2fbb24fcdc353125318c42a6e268a20231997
-
SHA256
b4546d0752195547450ad456636ce7123d6b8964fb12a22a110c6c4c3dfae453
-
SHA512
9eef97d7c9c23bfb1b27861974155c2892d34ecc5f0814c23747e86016f3cb55ddc61ffd4d1d91c2c546ff5284c5937b98dc509cd23e499a117b2dc513f76a2c
-
SSDEEP
12288:GgcsGI/cwSPZqJicrixOnaR1Na9gwSZaQkqFmaD2jlrlWgszXb8oOCKV3RF0GIkj:G5xuihOnc149gwaaqmxRWxT+F09k
Static task
static1
Behavioral task
behavioral1
Sample
4903ed7c47795ecf3e4b45617f02b0a4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4903ed7c47795ecf3e4b45617f02b0a4.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.tsssdomain.com - Port:
587 - Username:
[email protected] - Password:
LUMISuz1
Targets
-
-
Target
4903ed7c47795ecf3e4b45617f02b0a4.exe
-
Size
951KB
-
MD5
4903ed7c47795ecf3e4b45617f02b0a4
-
SHA1
60d2fbb24fcdc353125318c42a6e268a20231997
-
SHA256
b4546d0752195547450ad456636ce7123d6b8964fb12a22a110c6c4c3dfae453
-
SHA512
9eef97d7c9c23bfb1b27861974155c2892d34ecc5f0814c23747e86016f3cb55ddc61ffd4d1d91c2c546ff5284c5937b98dc509cd23e499a117b2dc513f76a2c
-
SSDEEP
12288:GgcsGI/cwSPZqJicrixOnaR1Na9gwSZaQkqFmaD2jlrlWgszXb8oOCKV3RF0GIkj:G5xuihOnc149gwaaqmxRWxT+F09k
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-