General
- Target Dekonnt-Formu20242103-pdf.exe
- Size 200KB
- Sample240321-vslfgsch69
- SHA256 42a2cffa81ab3350fec75227ca00e7e5e8ee9d5e71fda89e0d5cc9533c7eefea
- MD5 3c4ee0f0b8180b1e19f1f24ddbe413a4
- SHA1 f2803e268c693965ce640ddddee9377249a0c536
- SHA512 9f35f9175d5f2281455c8ee77fbd3fcad99db426a5c4a45b04cc21f699e47ccbd0d300e52a05201bd04c1b44aae2da8c9fab5b333943365723bd28abc685e4aa
- SSDEEP 3072:0oxMD/Y08Z4NU0+FWofaD634jstTfmEpoqR7VTs5/VtwukoZJ/1ZCqQ74bve07Ge:0kGg0/N2F4m+E6q9VTs5ttwS4qQ7seZ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Dekonnt-Formu20242103-pdf.exe
Resource
win7-20240221-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Dekonnt-Formu20242103-pdf.exe
Resource
win10v2004-20240226-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
ftp
-
Host
ftp://ftp.normagroup.com.tr
-
Port
21
-
Username
-
Password
Kingdom12345@
Extracted
Credentials
-
Protocol
ftp
-
Host
ftp.normagroup.com.tr
-
Port
21
-
Username
-
Password
Kingdom12345@
Targets
-
- Target Dekonnt-Formu20242103-pdf.exe
- Size 200KB
- SHA256 42a2cffa81ab3350fec75227ca00e7e5e8ee9d5e71fda89e0d5cc9533c7eefea
- MD5 3c4ee0f0b8180b1e19f1f24ddbe413a4
- SHA1 f2803e268c693965ce640ddddee9377249a0c536
- SHA512 9f35f9175d5f2281455c8ee77fbd3fcad99db426a5c4a45b04cc21f699e47ccbd0d300e52a05201bd04c1b44aae2da8c9fab5b333943365723bd28abc685e4aa
- SSDEEP 3072:0oxMD/Y08Z4NU0+FWofaD634jstTfmEpoqR7VTs5/VtwukoZJ/1ZCqQ74bve07Ge:0kGg0/N2F4m+E6q9VTs5ttwS4qQ7seZ
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext