General
-
Target
wiru.exe
-
Size
987KB
-
Sample
240424-vsd2eadg3y
-
MD5
a6455a248e43686bfda50622f2bd82d2
-
SHA1
de8544085d7969af9c9eda6cc418f26f9b144786
-
SHA256
a2b803974fcfb65e21fa1a7690eb2a4822f091a8bdf45786e2085c833871d5a0
-
SHA512
2820d87ffb9b1088dd61da458e4891d8247a3185099fe195e8fb5d2f8a135607eaf013b43718e347c30f0095bfe581a9e6d0b160ccba86d35dec168ea638aa2e
-
SSDEEP
12288:00QxgjNKY/6sBjn+lkNp6MARWch8k6SFkJkgskKA0kZPiDsRyNX5UrLB/ccOTOKw:00Qxgj8Y3n+lQkg6kZPiARysLBOTO+FG
Static task
static1
Behavioral task
behavioral1
Sample
wiru.exe
Resource
win11-20240412-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.oripam.xyz - Port:
587 - Username:
[email protected] - Password:
1yH[0T=asUG? - Email To:
[email protected]
Targets
-
-
Target
wiru.exe
-
Size
987KB
-
MD5
a6455a248e43686bfda50622f2bd82d2
-
SHA1
de8544085d7969af9c9eda6cc418f26f9b144786
-
SHA256
a2b803974fcfb65e21fa1a7690eb2a4822f091a8bdf45786e2085c833871d5a0
-
SHA512
2820d87ffb9b1088dd61da458e4891d8247a3185099fe195e8fb5d2f8a135607eaf013b43718e347c30f0095bfe581a9e6d0b160ccba86d35dec168ea638aa2e
-
SSDEEP
12288:00QxgjNKY/6sBjn+lkNp6MARWch8k6SFkJkgskKA0kZPiDsRyNX5UrLB/ccOTOKw:00Qxgj8Y3n+lQkg6kZPiARysLBOTO+FG
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-