General
-
Target
68a05a9e3757005a7b76d1bb0acb71c5_JaffaCakes118
-
Size
440KB
-
Sample
240522-zv9nbage6w
-
MD5
68a05a9e3757005a7b76d1bb0acb71c5
-
SHA1
efe1e7b2c7db5cea05f5b7c105d26bbbb5dd25cb
-
SHA256
dbfa1fc931cc9780a442228ce6ac46d68f4242153ee4dbd24bdf7d753188e185
-
SHA512
9c1bd0160db6c8266ac9c41b5abeb5671e58bc91fe3120fd5fb8a4507854195dac343475883376a0ac47b0679a4fb4617c455fbf1bf63339d959d845e3e93cec
-
SSDEEP
12288:zOI96t/qSwu6rGzQmepQMlrZa8HDA7+8iQy:zuqSwuUQwrbM7hiQy
Static task
static1
Behavioral task
behavioral1
Sample
TNT Consignment for 7048397463 Details.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
TNT Consignment for 7048397463 Details.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.groupedhb.com - Port:
587 - Username:
[email protected] - Password:
dBWS]QQE#giY
Targets
-
-
Target
TNT Consignment for 7048397463 Details.exe
-
Size
819KB
-
MD5
355bad609265bae95a6834b7dd69cd93
-
SHA1
9e3052dc4ffb53908327310ae87c784e17343cc4
-
SHA256
1b9451e9b76e1ca8efb1139b25e035ebc9fd9a4c5aebd9d5651b27828d3b6241
-
SHA512
8a9000bce658a50c0a94a23f5b19392f41b50c0ed6fe6511eb43da635743b76e530951f2d7b7b6ed5fb70e2cf38672fca84e6c216eb383904c06c14f7bccccb0
-
SSDEEP
12288:fb6mCM9sXHh9BoRPqsxOVKuS5r70xwgeqh043L97/hONSdoFmsgrgRQqthu:WeSHhYRRxOVGcxJBdb1KSSmsgrghu
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-