General
- Target DEKONT-90486589368903087689000000000000065.exe
- Size 337KB
- Sample240319-jcdj6ade99
- SHA256 660f2be2087d54741e99ef96df97b3d942b1a28e98bf9cc75109930111f7da87
- MD5 e8cedc119dbfa336ddeda9a24974b1a8
- SHA1 7054ed710ff2f1a1e7f82be54f5fff25a9d41bc3
- SHA512 fdbad1178daf587f4bfa6b28f11c0620b58e11f27438543524c25ec8db29d27923d41ed88fd9e86ff7f9d2708a1834ab182c3b2dc7091208a2abcbc642f435a0
- SSDEEP 3072:dDPDc6JSDNY3T2hEUm9eRsvendRIiiVqcdSB6O4ZGROYX+9wqY+mhhhmitqOd:dTDcsSuT2CUmPvoIKmSUO4iOYXKi
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DEKONT-90486589368903087689000000000000065.exe
Resource
win7-20231129-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
DEKONT-90486589368903087689000000000000065.exe
Resource
win10v2004-20240226-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
ftp
-
Host
ftp://ftp.normagroup.com.tr
-
Port
21
-
Username
-
Password
Kingdom12345@
Extracted
Credentials
-
Protocol
ftp
-
Host
ftp.normagroup.com.tr
-
Port
21
-
Username
-
Password
Kingdom12345@
Targets
-
- Target DEKONT-90486589368903087689000000000000065.exe
- Size 337KB
- SHA256 660f2be2087d54741e99ef96df97b3d942b1a28e98bf9cc75109930111f7da87
- MD5 e8cedc119dbfa336ddeda9a24974b1a8
- SHA1 7054ed710ff2f1a1e7f82be54f5fff25a9d41bc3
- SHA512 fdbad1178daf587f4bfa6b28f11c0620b58e11f27438543524c25ec8db29d27923d41ed88fd9e86ff7f9d2708a1834ab182c3b2dc7091208a2abcbc642f435a0
- SSDEEP 3072:dDPDc6JSDNY3T2hEUm9eRsvendRIiiVqcdSB6O4ZGROYX+9wqY+mhhhmitqOd:dTDcsSuT2CUmPvoIKmSUO4iOYXKi
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext