General
-
Target
52ffbae604ce2fa4d555e27cdf935dd7edeb541a1b493986eece35498032a47d
-
Size
707KB
-
Sample
240327-cgf3hsda2x
-
MD5
b8810e52908a4c9b1f28e01fa661f99d
-
SHA1
b739d00245187bc0aa72acc36cce0d42a9548e58
-
SHA256
52ffbae604ce2fa4d555e27cdf935dd7edeb541a1b493986eece35498032a47d
-
SHA512
fe3584d009d5bc5c5927c852d6467ef5e72ae2fc6b0ea4c229d5921ad00ff5a1ab08d44a3962d6c8aee462534f5568525f8f1dfc84e83a0b6c7080f484057b9c
-
SSDEEP
12288:yCjCLa5Wdx98W7r7I3kBxQOL7FR2769b4b6M7h6fgyzZI:FjC5dkWHMjSplbjKyz
Static task
static1
Behavioral task
behavioral1
Sample
52ffbae604ce2fa4d555e27cdf935dd7edeb541a1b493986eece35498032a47d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
52ffbae604ce2fa4d555e27cdf935dd7edeb541a1b493986eece35498032a47d.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.normagroup.com.tr - Port:
21 - Username:
[email protected] - Password:
Kingdom12345@
Extracted
Protocol: ftp- Host:
ftp.normagroup.com.tr - Port:
21 - Username:
[email protected] - Password:
Kingdom12345@
Targets
-
-
Target
52ffbae604ce2fa4d555e27cdf935dd7edeb541a1b493986eece35498032a47d
-
Size
707KB
-
MD5
b8810e52908a4c9b1f28e01fa661f99d
-
SHA1
b739d00245187bc0aa72acc36cce0d42a9548e58
-
SHA256
52ffbae604ce2fa4d555e27cdf935dd7edeb541a1b493986eece35498032a47d
-
SHA512
fe3584d009d5bc5c5927c852d6467ef5e72ae2fc6b0ea4c229d5921ad00ff5a1ab08d44a3962d6c8aee462534f5568525f8f1dfc84e83a0b6c7080f484057b9c
-
SSDEEP
12288:yCjCLa5Wdx98W7r7I3kBxQOL7FR2769b4b6M7h6fgyzZI:FjC5dkWHMjSplbjKyz
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-