General
-
Target
27ceddc87795eb0c1fec50f8da2f94cea865d7de14ed569541d629c099d63296.z
-
Size
663KB
-
Sample
240509-l2hxaaeg76
-
MD5
05dda5cb7335c6c9f7a7d00dc6dbd49b
-
SHA1
504d9e0730c58798257104f126aadb5686ca3a04
-
SHA256
27ceddc87795eb0c1fec50f8da2f94cea865d7de14ed569541d629c099d63296
-
SHA512
02de74fe2033708c35c9969403c08c2720dda3297e34dd37842b09e5f0f175431fbe2a868ce935906ea93b809edd9890226bb21e9ba517723a53d6b0ee5fec75
-
SSDEEP
12288:LEXGi1mgnJXQQ4OQ/g3+EvAEB5uAgiN9u+m+N0YSBQNdH9FugOo:LEXGgndSc+S3zW+WpQrHCgOo
Malware Config
Extracted
Protocol: smtp- Host:
mail.deeptrans.com.tr - Port:
587 - Username:
[email protected] - Password:
59ace821A
Targets
-
-
Target
CustomInvoice_WaybillDoc_TransprotLabel_78060565761052024.exe
-
Size
1.1MB
-
MD5
4bb4e01a5370b516309f202e9ae67065
-
SHA1
909b4e79ef64bfaaf00c670a329eddff2a013300
-
SHA256
8b595373f715ca3fdcfb46ad318afa8c3a0bce743c790d572d57787a986f5887
-
SHA512
70a5ea29b0b66c256abd2d92e6cccf4b14b56f14a92e49fa9e2e14075ee94c8c79d31d9be88310dea42f0f93ddd5d8efad0775af27f3e295605b65ff943f4673
-
SSDEEP
24576:bqDEvCTbMWu7rQYlBQcBiT6rprG8a4Mf8XMZqXYEQAaSiKpjNQ:bTvC/MTQYxsWR7a4MEMZa/is
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-