General
-
Target
387951111703db9afb653edb5533ca3ee76c169dc250a7a8de033f44062dc613
-
Size
606KB
-
Sample
240503-bhx7rabc2x
-
MD5
633e53c38726864f50f41361bc72db78
-
SHA1
7ee68c957bee37ef03305e7c0509ec6cacc15c73
-
SHA256
387951111703db9afb653edb5533ca3ee76c169dc250a7a8de033f44062dc613
-
SHA512
2ee6d2f765a04f2b2963c9ee9d0a2312c7c69ab156e02bc667b8cfa03218c1a5efe463a152df2dff0f2ea8bb9bbd0aca5f5ce0f53326734e20be861e89afa4b1
-
SSDEEP
12288:lq0zhKWshWqItlXD9QteEMVuog83+L6Oql+A4eFHmU4HaX7cgJJXWJORqWa:Q0XsBY9TVuK3+Yl14eJmUpLcgJBIOva
Static task
static1
Behavioral task
behavioral1
Sample
387951111703db9afb653edb5533ca3ee76c169dc250a7a8de033f44062dc613.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
387951111703db9afb653edb5533ca3ee76c169dc250a7a8de033f44062dc613.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.normagroup.com.tr - Port:
21 - Username:
[email protected] - Password:
Bossu_56@@12345@_
Targets
-
-
Target
387951111703db9afb653edb5533ca3ee76c169dc250a7a8de033f44062dc613
-
Size
606KB
-
MD5
633e53c38726864f50f41361bc72db78
-
SHA1
7ee68c957bee37ef03305e7c0509ec6cacc15c73
-
SHA256
387951111703db9afb653edb5533ca3ee76c169dc250a7a8de033f44062dc613
-
SHA512
2ee6d2f765a04f2b2963c9ee9d0a2312c7c69ab156e02bc667b8cfa03218c1a5efe463a152df2dff0f2ea8bb9bbd0aca5f5ce0f53326734e20be861e89afa4b1
-
SSDEEP
12288:lq0zhKWshWqItlXD9QteEMVuog83+L6Oql+A4eFHmU4HaX7cgJJXWJORqWa:Q0XsBY9TVuK3+Yl14eJmUpLcgJBIOva
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-