General
-
Target
SecuriteInfo.com.Win32.TrojanX-gen.28596.11026
-
Size
38KB
-
Sample
240219-bz3hssgh38
-
MD5
5ce3e02008f0275195991cb879f41d6c
-
SHA1
3d7ebb26ed36a6d17ee11a873edb82be75769d53
-
SHA256
e2cf4663d4badd0319265b4be656d915d3ad07dabd388d4733f49915b13d464e
-
SHA512
0615ecf7004fee6aad636e0d5e37e9fbe58c821d5a4134906325fa52ca1dbfc0eb76f77e726f4529de33d4928bf6c8ee68e832df7451f1a9cdb746ac678e5cba
-
SSDEEP
768:AORn0rfMNi+jDz9mZRGDYxcTgb6igeVmc6PSHqJdNZln:5Rn0YNiqDz9aRGDucUbvRXHqJr
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.TrojanX-gen.28596.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.TrojanX-gen.28596.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.gasplants.quest - Port:
587 - Username:
[email protected] - Password:
chinomso4292
Extracted
agenttesla
Protocol: smtp- Host:
mail.gasplants.quest - Port:
587 - Username:
[email protected] - Password:
chinomso4292 - Email To:
[email protected]
Targets
-
-
Target
SecuriteInfo.com.Win32.TrojanX-gen.28596.11026
-
Size
38KB
-
MD5
5ce3e02008f0275195991cb879f41d6c
-
SHA1
3d7ebb26ed36a6d17ee11a873edb82be75769d53
-
SHA256
e2cf4663d4badd0319265b4be656d915d3ad07dabd388d4733f49915b13d464e
-
SHA512
0615ecf7004fee6aad636e0d5e37e9fbe58c821d5a4134906325fa52ca1dbfc0eb76f77e726f4529de33d4928bf6c8ee68e832df7451f1a9cdb746ac678e5cba
-
SSDEEP
768:AORn0rfMNi+jDz9mZRGDYxcTgb6igeVmc6PSHqJdNZln:5Rn0YNiqDz9aRGDucUbvRXHqJr
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-