General
-
Target
4f7824c1dee1a075898e66126a9f6678c41d77507e6510ca88a597ccc8a05b55.exe
-
Size
1.1MB
-
Sample
240328-cqh88sda4z
-
MD5
832eec80b76d70fc68c511965da69ccc
-
SHA1
9ea0a03a1efb97b3aecc456950af053d813e0afe
-
SHA256
4f7824c1dee1a075898e66126a9f6678c41d77507e6510ca88a597ccc8a05b55
-
SHA512
ed6350dc50d935aef423d27506b3e4dc15a4b26b3f5fe7fbbac0ab2c04c0ddb3552f8e04845061ef07fea9fe714d0c2c512bcc42ff561617f94be7c2b0b775cf
-
SSDEEP
24576:YqDEvCTbMWu7rQYlBQcBiT6rprG8aF83aszMg15alQt3d:YTvC/MTQYxsWR7aFwfMgzK
Static task
static1
Behavioral task
behavioral1
Sample
4f7824c1dee1a075898e66126a9f6678c41d77507e6510ca88a597ccc8a05b55.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4f7824c1dee1a075898e66126a9f6678c41d77507e6510ca88a597ccc8a05b55.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.ionos.es - Port:
587 - Username:
sevialup@sevialup.es - Password:
Pula0001* - Email To:
cludsewe3@gmail.com
Targets
-
-
Target
4f7824c1dee1a075898e66126a9f6678c41d77507e6510ca88a597ccc8a05b55.exe
-
Size
1.1MB
-
MD5
832eec80b76d70fc68c511965da69ccc
-
SHA1
9ea0a03a1efb97b3aecc456950af053d813e0afe
-
SHA256
4f7824c1dee1a075898e66126a9f6678c41d77507e6510ca88a597ccc8a05b55
-
SHA512
ed6350dc50d935aef423d27506b3e4dc15a4b26b3f5fe7fbbac0ab2c04c0ddb3552f8e04845061ef07fea9fe714d0c2c512bcc42ff561617f94be7c2b0b775cf
-
SSDEEP
24576:YqDEvCTbMWu7rQYlBQcBiT6rprG8aF83aszMg15alQt3d:YTvC/MTQYxsWR7aFwfMgzK
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects executables referencing Windows vault credential objects. Observed in infostealers
-
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
-
Detects executables referencing many email and collaboration clients. Observed in information stealers
-
Detects executables referencing many file transfer clients. Observed in information stealers
-
Suspicious use of SetThreadContext
-