General
-
Target
0b4b35e760728afc9d3e9a3b093a9f69a8507ffcafbe6c8e5b424fedb540096f
-
Size
733KB
-
Sample
240511-j5z9magb8z
-
MD5
51c8fa9ab5956f67c3e8bc842ffd0a8f
-
SHA1
019a8a05fcacd1c900fcb0c70da2b342a49c09fd
-
SHA256
0b4b35e760728afc9d3e9a3b093a9f69a8507ffcafbe6c8e5b424fedb540096f
-
SHA512
29133118f2cc161f0054faf182a3732ef0a45c90be5f8c366674d32d25a3d4c4d5935a2fd61ced73940f4647a10d98b22a584f4b4fd59c4a1dd683006658ba58
-
SSDEEP
12288:Po6/r8JlMKa8QAbnVBWSggDm8HHwjP3qauqJo5peJSMvhWyNoca1P9ghu30NZprk:Po6g36APW/QbnMSu+jeQcWyBY9ghu3gU
Static task
static1
Behavioral task
behavioral1
Sample
50c24050cc83700989bbb281afd290df47f864702e0a957f1db1800a2c34b25c.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
50c24050cc83700989bbb281afd290df47f864702e0a957f1db1800a2c34b25c.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.deeptrans.com.tr - Port:
587 - Username:
[email protected] - Password:
59ace821A
Targets
-
-
Target
50c24050cc83700989bbb281afd290df47f864702e0a957f1db1800a2c34b25c.exe
-
Size
1.1MB
-
MD5
b769c82e7f0aeb48129c514b6ee3eefc
-
SHA1
19bd8f4cbd6422003331d9d2de11e3a7f973b0a3
-
SHA256
50c24050cc83700989bbb281afd290df47f864702e0a957f1db1800a2c34b25c
-
SHA512
97e5b8baf06b6f210cd8e9e8388963ea77b145b0192cb8af8ae7d5b088f0bdba7cedcd5100bdff61d64cb0a85bfbd69115a15e50ce4d0b7c4c43b8586098033d
-
SSDEEP
24576:tqDEvCTbMWu7rQYlBQcBiT6rprG8aGKSeHIqatQGNQp:tTvC/MTQYxsWR7aGKSeumGy
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-