General
-
Target
20052024124620052024ProformaInvoice40812pdf_NeikiAnalytics
-
Size
681KB
-
Sample
240521-jxrbradg93
-
MD5
364e8eba63cccdde2b8df15eb1cd6171
-
SHA1
2c1675a3e1df3164e9ae475dade4165884593115
-
SHA256
4f369420163b8ccf4e5066e983955467e13c808d470f531b101786735607477d
-
SHA512
920b617e5988a1de08e26c56c41cc4a297a65d26f0dd5f78888b54c5341be1305b55461ded008cc03edea54cbf977da9bde108a96019c8957653c21f2a4bde89
-
SSDEEP
12288:35st/s0OfCseH77dJMlN5KSXe4kJzFFSdbZP/Y3eYQCy6AzFQWL+3DfhpOj/0:35st/s0OfCseH3jMlTPuVJKdVPX6oP+J
Static task
static1
Behavioral task
behavioral1
Sample
fjNoJupuvPDWD4X.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
fjNoJupuvPDWD4X.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
emidco.com - Port:
587 - Username:
[email protected] - Password:
DMmpPxx9c - Email To:
[email protected]
Targets
-
-
Target
fjNoJupuvPDWD4X.exe
-
Size
760KB
-
MD5
0df7d42d9cfa112349469b3f4c8a8dbf
-
SHA1
01c192b38345e11b1dfe13d247ff6fcabb04f6d7
-
SHA256
50b02bb88174e117061cc4d557c9977ffc022a4f1f3870d36ef9e5deab49bbc6
-
SHA512
d1936b46bb8ccfbf74b20f2303e6738a1147a86d688dd4c894bc5d8b9a4f4c5a5b443fe99c61fdf335de3cac96f5fa25172704d682249d4b67d77058ef5cc8a0
-
SSDEEP
12288:2IcWET/mr9K+22BEEzFatnZFL/0K1AjI1NFeurFM9jgGGRfhOOs13fRV0RTAVeAd:0Wtb3BE7FzK81NEaFMO9N1gsaVeABEbi
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-