General
-
Target
SecuriteInfo.com.Heur.2253.2163.exe
-
Size
679KB
-
Sample
240326-197myadh57
-
MD5
b1422d1b2edbf5a25a17fd89554a34b0
-
SHA1
79bd1dcad0fa6155fbca11c9a3500baaf46288af
-
SHA256
d1f0868ae3889a44d3a0f4e0650c8c9f0806cbae37dd5d8966376463b6bcf505
-
SHA512
2a83d96c2296f53883ce2a2f2004b9f9931adaae8a513782b62a9aebc623b4e4852d185a0fe15944e24c741c6eddf0c31f7366a2ce6360e28dac0193679369d1
-
SSDEEP
12288:XXqLha5WlNOqfQOztCLLboHdZ6oTePvmkVZJ654R00aqPnfgfIPK1DO88t:nqHp4O+LMZ6oTeP/BccCqfr
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Heur.2253.2163.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Heur.2253.2163.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.ipr-co.org - Port:
587 - Username:
[email protected] - Password:
IPRco@100102@ - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.ipr-co.org - Port:
587 - Username:
[email protected] - Password:
IPRco@100102@
Targets
-
-
Target
SecuriteInfo.com.Heur.2253.2163.exe
-
Size
679KB
-
MD5
b1422d1b2edbf5a25a17fd89554a34b0
-
SHA1
79bd1dcad0fa6155fbca11c9a3500baaf46288af
-
SHA256
d1f0868ae3889a44d3a0f4e0650c8c9f0806cbae37dd5d8966376463b6bcf505
-
SHA512
2a83d96c2296f53883ce2a2f2004b9f9931adaae8a513782b62a9aebc623b4e4852d185a0fe15944e24c741c6eddf0c31f7366a2ce6360e28dac0193679369d1
-
SSDEEP
12288:XXqLha5WlNOqfQOztCLLboHdZ6oTePvmkVZJ654R00aqPnfgfIPK1DO88t:nqHp4O+LMZ6oTeP/BccCqfr
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-