General
-
Target
548531691a1f11f45a2ba5992189222641973d159f4963f3d3cbb241a82da1ed
-
Size
624KB
-
Sample
240327-ckr9ysab28
-
MD5
f80b7e5b587c08e80e0c4b3e6ee5fdba
-
SHA1
add3f4490639fea442d00e6f76b0c558dedab492
-
SHA256
548531691a1f11f45a2ba5992189222641973d159f4963f3d3cbb241a82da1ed
-
SHA512
618592deaef7c2a36c87e04e68ab9212aae026ad0ff6cd25070f17f46a3156c03d56c68f754e779bf96f60adcd545da695a6157ad9d5b22bc71aa1b25213801b
-
SSDEEP
12288:1v6w+e7jln+CjZ/4a6FB1Mt2dHqtp9bHlcVMSsski7fewVa5WQkR:1v9n+slZzvplcVMSsNiywPX
Static task
static1
Behavioral task
behavioral1
Sample
548531691a1f11f45a2ba5992189222641973d159f4963f3d3cbb241a82da1ed.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
548531691a1f11f45a2ba5992189222641973d159f4963f3d3cbb241a82da1ed.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
godwillxzn.com - Port:
587 - Username:
[email protected] - Password:
,~B=)#zzr)o= - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
godwillxzn.com - Port:
587 - Username:
[email protected] - Password:
,~B=)#zzr)o=
Targets
-
-
Target
548531691a1f11f45a2ba5992189222641973d159f4963f3d3cbb241a82da1ed
-
Size
624KB
-
MD5
f80b7e5b587c08e80e0c4b3e6ee5fdba
-
SHA1
add3f4490639fea442d00e6f76b0c558dedab492
-
SHA256
548531691a1f11f45a2ba5992189222641973d159f4963f3d3cbb241a82da1ed
-
SHA512
618592deaef7c2a36c87e04e68ab9212aae026ad0ff6cd25070f17f46a3156c03d56c68f754e779bf96f60adcd545da695a6157ad9d5b22bc71aa1b25213801b
-
SSDEEP
12288:1v6w+e7jln+CjZ/4a6FB1Mt2dHqtp9bHlcVMSsski7fewVa5WQkR:1v9n+slZzvplcVMSsNiywPX
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-