General
-
Target
9c9908d9a8db6ad301678e96d136ddd9.bin
-
Size
534KB
-
Sample
240329-c9gvhsfg4s
-
MD5
68fcd1a1d92b63d8e1700c86cf01d76d
-
SHA1
73ce829ebcbfc9266a1d5eeb86979acf6be72229
-
SHA256
0d344a135444176f953758de2fb959c50b1490704b9eb1fd7da7d5d9b8b63235
-
SHA512
b107901a2a6d52ab88ec53b7eba4b0167013f41cbcb03a946b657b175e2d28fa1d53453c73b7630ceab4cd4ad4c73cbd69921c19b3345cc586689e6bd1861b23
-
SSDEEP
12288:7f12j1Wv9u2sz9n5UtBMr5AqUpecSJA+du:gQFu2S9e4YpecSS+s
Static task
static1
Behavioral task
behavioral1
Sample
cf6aced16f19b2a2a0ac5266565f3b794e42e405fc570b5df344daa3c3d1d5bb.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cf6aced16f19b2a2a0ac5266565f3b794e42e405fc570b5df344daa3c3d1d5bb.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.vila-gabriel.ro - Port:
21 - Username:
[email protected] - Password:
bVkMH6R.pfF~NN@ossy$W!_pz[bh!9l(MU%UtX9L^W}vO=mn*g*;]}]
Targets
-
-
Target
cf6aced16f19b2a2a0ac5266565f3b794e42e405fc570b5df344daa3c3d1d5bb.exe
-
Size
967KB
-
MD5
9c9908d9a8db6ad301678e96d136ddd9
-
SHA1
21f346ed1ea18080fd711c119a204ae89c7e8771
-
SHA256
cf6aced16f19b2a2a0ac5266565f3b794e42e405fc570b5df344daa3c3d1d5bb
-
SHA512
68338ed95fbecbc86daefa985c5839be356f8e3fd90e972c282522da6dba3c673b684146946d6ef210fdda328eaebf108e2bf990feee8cb82f382c48268ea33e
-
SSDEEP
12288:ZSKMpm64v7Zh6PsSUkynkGZe2uVu0NQMlmNnT/RpXAlT3kw7BjZ5QDAdCDbjq/GE:ZS5j4v7KPsbkrDjWTJpwlT0m/Q0
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-