General
-
Target
22052024_1242_21052024_PP-X-CC-0103188098.gz
-
Size
514KB
-
Sample
240522-pxfg5sbf99
-
MD5
518b17886430eb0c71761b7f4af0eeb8
-
SHA1
64171df7dfc1297ad72a77a2e1a173c2b43b00c8
-
SHA256
4c285aab8162fc0047a1a79f6403a490cdb701591a7fdef4d30d5730bff51649
-
SHA512
e8799d670d19e6b7c68cb79fc8f6fa177fc45f4a1a9fa42e0f1562de652f5bbca96ac8f4c9cc7e87d579d71215df3351b30d520884431d011bb1f58ee22aeb69
-
SSDEEP
12288:3EjK3w5Gp2A8kRxR3A0EYjdwPKlZcLmsyZO:3Ekwsp26RXQGpEKlZcLmhZO
Static task
static1
Behavioral task
behavioral1
Sample
PP-X-CC-0103188098.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PP-X-CC-0103188098.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.corpsa.net - Port:
21 - Username:
[email protected] - Password:
ko=8J2,OjDt,
Targets
-
-
Target
PP-X-CC-0103188098.exe
-
Size
1005KB
-
MD5
753373ea799f4286a93a3f4527b3888b
-
SHA1
a6865cc98ab5659ed16eb3781100d0b85ba86af3
-
SHA256
b2ebb908944dcf31b253f02097b86b3e1f96fe094bbcc7c2c37718ade401991c
-
SHA512
5fbe15c82873bf667ef26ce18703f3883e724456e379795bee989f841b9ff002430be5d8b4382f84e30bb8982ccb67af10d61d683422158928f651d1441e0555
-
SSDEEP
24576:WAHnh+eWsN3skA4RV1Hom2KXMmHax/yNI17L/i5:xh+ZkldoPK8YaxuS7M
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-