General
-
Target
e0f74804335cf2b5cd297bbd0ba8fceb
-
Size
1.3MB
-
Sample
240327-g2dkcahd3s
-
MD5
e0f74804335cf2b5cd297bbd0ba8fceb
-
SHA1
0d424c3f4e248851eca752b6af1e216a1d55cf6e
-
SHA256
9110e87e7688be659861a7f9ca8f4aecd1906ef550b9b0864bf5560613c1d5e9
-
SHA512
6f03f89abaa79d9363811f2bf53c1bc23776b334c12e80f22d928783fc89afb6c3de3003c92bb786153b4996b2ecdae467e8239984419d74ce5a6aa3eb0f4506
-
SSDEEP
24576:Q/OsBgo0q4wMuBmCmTOUd+L6khXWCX9U96RAtBjLmKXpxpudZeGu9:Q2oHMSmCm6Ud+zhXxtU0Reimdu2
Static task
static1
Behavioral task
behavioral1
Sample
e0f74804335cf2b5cd297bbd0ba8fceb.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e0f74804335cf2b5cd297bbd0ba8fceb.exe
Resource
win10v2004-20240319-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cairoshippinginternational.com - Port:
587 - Username:
[email protected] - Password:
NermoSamy@2006+ - Email To:
[email protected]
Targets
-
-
Target
e0f74804335cf2b5cd297bbd0ba8fceb
-
Size
1.3MB
-
MD5
e0f74804335cf2b5cd297bbd0ba8fceb
-
SHA1
0d424c3f4e248851eca752b6af1e216a1d55cf6e
-
SHA256
9110e87e7688be659861a7f9ca8f4aecd1906ef550b9b0864bf5560613c1d5e9
-
SHA512
6f03f89abaa79d9363811f2bf53c1bc23776b334c12e80f22d928783fc89afb6c3de3003c92bb786153b4996b2ecdae467e8239984419d74ce5a6aa3eb0f4506
-
SSDEEP
24576:Q/OsBgo0q4wMuBmCmTOUd+L6khXWCX9U96RAtBjLmKXpxpudZeGu9:Q2oHMSmCm6Ud+zhXxtU0Reimdu2
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-