General
-
Target
21052024145620052024Quotation52000142024docx.rar
-
Size
693KB
-
Sample
240522-wjer1sbb29
-
MD5
309612b0089bed84949697ca77f39307
-
SHA1
5be41217067375f34a6f463961f97b92baff8c5e
-
SHA256
1dd5a09cb94c09e726de5c72b3a0ae121b11e195f43dc49944954822206ffa18
-
SHA512
5a9f415687a1fab4a0cfa32f8b387f8b1e5c48ca786b9ab6260ffe76de5594ba474494b234ff3ac718fe12245c575cb69399ab7f553f1dfe7f1e0c26cb4ddbbc
-
SSDEEP
12288:GywCQ1jlOJNCCUlnGFRnj+CB1zxQ1plYhflnAQ9SC2bQ9CqpaQbfC:j8j2ZVDB/SpaZlAQP2bQ9CqpaQTC
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
emidco.com - Port:
587 - Username:
[email protected] - Password:
DMmpPxx9c - Email To:
[email protected]
Targets
-
-
Target
50ZZk7HiITiwndh.exe
-
Size
720KB
-
MD5
2bee3a88220e7fe1c07a153b134e6b27
-
SHA1
75ff17e5ae97389b1bed55d28355fc33ca69ea33
-
SHA256
3a63d678ce5318dce83c3ebabe2daad7fae4b324f6dabeb7199719a464313ad8
-
SHA512
68474244a01b623c333c52f014593c6c3809518d2f29e41e0d701440f54a7a502c8a623ac6f4a61ca6419763d649c81cd370154324eac36ae53a52b06760833d
-
SSDEEP
12288:QQPAq0mIMUCA8GfkNekupi4OdnqAhdusnNRCvfbVQvgF1Sf3NhJ/Jym/HEhY3BF/:kq6MvAf8NiU4jAhduyWvT2vgK3J/80Hl
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-