General
-
Target
16942556838.zip
-
Size
1.8MB
-
Sample
240429-mw7twsgg66
-
MD5
20124d9cc94bd0ff654fdcd968a491ac
-
SHA1
b4b14919ce873323c40aab62f1498812ac820f08
-
SHA256
70dc16a7a405f69888be5061308da23037102d0de8f9aaee9a690591da805939
-
SHA512
201b10db24eebb3b658676876babe0000ac9771b3a889001aa958efadd10036d4ed8f7b52a76006dff2f797f84cc532b5877c249633d52b76325fa883efa3bf3
-
SSDEEP
49152:lrjpZDSAA8zoIlpJgFfuSprk4FREBkicGDrq3p5w6rBa:lrjbRxzL82Sprk4DdiBDGkgBa
Static task
static1
Behavioral task
behavioral1
Sample
Ажурирање документације ФРКС-В201.0224034370.xlsx.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Ажурирање документације ФРКС-В201.0224034370.xlsx.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.svetigeorgije.co.rs - Port:
21 - Username:
[email protected] - Password:
4c5H&b2whkD9
Targets
-
-
Target
Ажурирање документације ФРКС-В201.0224034370.xlsx.exe
-
Size
3.3MB
-
MD5
ac5987973a9aaf18af3f907822486142
-
SHA1
7112407d4894cf50db9ee63dd8737d888be5e99b
-
SHA256
b4661a2af6703921e7608f403c0c99d2c36e96382eb2a5103f9f110e1f07cd25
-
SHA512
96536129c3e1466b286b336cd1b7abbcbf6e04d24dade250163063cc6b75acdcea200b44e820fd4332e8d0413c27bf57d5806b79a00e41d08eb0e98c57276fb4
-
SSDEEP
49152:Ap98Mq2HVhbeiMvZ1HiVbwL2SjWgl2LsJu9nBKfTxIQFTxl3F4CE2/OzvL+4U/bV:AR1hNMiwLPqLsJ04R/bV
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-