General
-
Target
DEKONT - 20240327-g0CiifOO4eIH5dL.exe
-
Size
740KB
-
Sample
240327-smqf5saa71
-
MD5
1dca538763d8b13f4eb4a059e9a98e3a
-
SHA1
be4c6dcf98860463c94596a6febcd404ae1ffc22
-
SHA256
0353461e3456838001ee98fd63e0df5563fab3836b26600059e4deed142a73f6
-
SHA512
c8b6dd0f01e9667d13d09c8bdfd2d179bf1877b4f8c771d9e4b018f3452ad007583c1d3617154bdc02c43c8949ee42c0959015cd1270aa125cb2de314485823c
-
SSDEEP
12288:Rd1JsJ6Sj31Sh2iNw25j2T50NBEursHNtPZLsWajF6QWDBVpv+ONfLemSgTGKCP0:Rdkw1G2prBbrsHN9ZLsNh1CBX3NzemjO
Static task
static1
Behavioral task
behavioral1
Sample
DEKONT - 20240327-g0CiifOO4eIH5dL.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
DEKONT - 20240327-g0CiifOO4eIH5dL.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.normagroup.com.tr - Port:
21 - Username:
[email protected] - Password:
Kingdom12345@
Extracted
Protocol: ftp- Host:
ftp.normagroup.com.tr - Port:
21 - Username:
[email protected] - Password:
Kingdom12345@
Targets
-
-
Target
DEKONT - 20240327-g0CiifOO4eIH5dL.exe
-
Size
740KB
-
MD5
1dca538763d8b13f4eb4a059e9a98e3a
-
SHA1
be4c6dcf98860463c94596a6febcd404ae1ffc22
-
SHA256
0353461e3456838001ee98fd63e0df5563fab3836b26600059e4deed142a73f6
-
SHA512
c8b6dd0f01e9667d13d09c8bdfd2d179bf1877b4f8c771d9e4b018f3452ad007583c1d3617154bdc02c43c8949ee42c0959015cd1270aa125cb2de314485823c
-
SSDEEP
12288:Rd1JsJ6Sj31Sh2iNw25j2T50NBEursHNtPZLsWajF6QWDBVpv+ONfLemSgTGKCP0:Rdkw1G2prBbrsHN9ZLsNh1CBX3NzemjO
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-