General
-
Target
707b90ec211ff5a1c9292f80fdee0b36.bin
-
Size
693KB
-
Sample
240329-cq7ltsfb2y
-
MD5
7a81c94a74aff61e2fb48ab633daa1fc
-
SHA1
5f61c6c09e95fc3d10c6db4a70ffb3e902007a0c
-
SHA256
2763cdab768885c25996fbcd527bb9f63f5cbb1bd60861f5463f7c25e46d9025
-
SHA512
74e87f0c0da56e0645c60761b1183cd1b5f47b9ee67d95bc6416793b75f057e094b31f1f3ccba45b45205aaf4b30e2e277b91f50b1e1419b39b37e12c32e0df8
-
SSDEEP
12288:sMQ6LFTDg/aWH+FJBGAnn3gG/Sp8wA07DQuMGvwSh6p3HAAPzmw1nTet:sMxlDg/aWenp5Kp8wAvbGYY6RgAP31nm
Static task
static1
Behavioral task
behavioral1
Sample
f1ac86388ffe376b99f91b580e0d31128f385954d790121561717ed6bbb6561b.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
f1ac86388ffe376b99f91b580e0d31128f385954d790121561717ed6bbb6561b.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.starlinetrading.com - Port:
587 - Username:
[email protected] - Password:
Tmn@#1571963?% - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.starlinetrading.com - Port:
587 - Username:
[email protected] - Password:
Tmn@#1571963?%
Targets
-
-
Target
f1ac86388ffe376b99f91b580e0d31128f385954d790121561717ed6bbb6561b.exe
-
Size
829KB
-
MD5
707b90ec211ff5a1c9292f80fdee0b36
-
SHA1
5fa7e481b898e93a2438a9902bbc12b64368191a
-
SHA256
f1ac86388ffe376b99f91b580e0d31128f385954d790121561717ed6bbb6561b
-
SHA512
4da929a2c1d4f7dc48df4989f3d24af42ab4c9bb236864fcdde44ea93f04913b59797e4090cea6c063c0beb2efde6e32b592931924db4fa5cde9377d36981485
-
SSDEEP
12288:KsMa2YUjyww0wiQ6lD1vOccAw13MBcveJuGhRa6VmLM3YWAydbfqD6HaK7ec9S:KsMa2Y2jomFWP13ycveAGoM3YW
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-