General
-
Target
e72ab72a888f6ef0627bb1ea5452a168792d1dc4037b74c34cc557eb5d2fe000.exe
-
Size
652KB
-
Sample
240110-sa1fksadd7
-
MD5
9d30ae0d6ded92562cfcc7e1315d5412
-
SHA1
1c91fc6a40e584831b992be826420ade1b017394
-
SHA256
e72ab72a888f6ef0627bb1ea5452a168792d1dc4037b74c34cc557eb5d2fe000
-
SHA512
44e610657b33cd07114431d9fff4eda53c61af0200c84546a261a25197252a140beb19aa9f13ab551d520e3b9a001aaa47779c6713b1be529f91a852ed29ce81
-
SSDEEP
12288:xIzUO2UHtGPlTFcqq23IBHqAsGmiBm4Ok0SiZxp4K:yLVarcF5BKA/TzGMK
Malware Config
Extracted
Protocol: smtp- Host:
mail.borsanborek.com.tr - Port:
587 - Username:
[email protected] - Password:
Io@267726@o
Extracted
agenttesla
Protocol: smtp- Host:
mail.borsanborek.com.tr - Port:
587 - Username:
[email protected] - Password:
Io@267726@o - Email To:
[email protected]
Targets
-
-
Target
e72ab72a888f6ef0627bb1ea5452a168792d1dc4037b74c34cc557eb5d2fe000.exe
-
Size
652KB
-
MD5
9d30ae0d6ded92562cfcc7e1315d5412
-
SHA1
1c91fc6a40e584831b992be826420ade1b017394
-
SHA256
e72ab72a888f6ef0627bb1ea5452a168792d1dc4037b74c34cc557eb5d2fe000
-
SHA512
44e610657b33cd07114431d9fff4eda53c61af0200c84546a261a25197252a140beb19aa9f13ab551d520e3b9a001aaa47779c6713b1be529f91a852ed29ce81
-
SSDEEP
12288:xIzUO2UHtGPlTFcqq23IBHqAsGmiBm4Ok0SiZxp4K:yLVarcF5BKA/TzGMK
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-