General
- Target nTX895780888999-268900DRU908890032890.LZH.zip
- Size 651KB
- Sample240607-mrpgrafa3v
- SHA256 3cfa153bee0e1dad60277973903d6123a6ef02bfb958f08eb77fad3a06d8439c
- MD5 ac6c43af3223aacabdf489732c108121
- SHA1 8671730af956c404c5eead45b75a7cd81b1333c9
- SHA512 b3625ec246527f5adc1c3904e0b58de1838eec595f9f8925ea403fc0b0fe5c829e49b10c6566de6ec47c69517978549df409b13c32561439819489a043862acd
- SSDEEP 12288:qjPGpcvIeZ5D2KQYtO7IhKEkPOp0VbnLRU2qyuCc6U089l7maaeDe:qKpHmDiYtU2uDL6CmZ0898aaea
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
TX895780888999-268900DRU908890032890.exe
Resource
win7-20240508-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
TX895780888999-268900DRU908890032890.exe
Resource
win10v2004-20240426-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
cp8nl.hyperhost.ua
-
Port
587
-
Username
-
Password
@qwerty90123
-
Email to
Targets
-
- Target TX895780888999-268900DRU908890032890.exe
- Size 1.1MB
- SHA256 c0cb57fc9baa9ee1d50147c106a363d2c6533f39f3cc4d509294b1faeef9eac6
- MD5 eab04ba8851e5ff9a16555aa714be99c
- SHA1 d8bd9ac62747f146088d69cc4f97385535c78241
- SHA512 79a19e05c33eb5fd817f1151d673278b8a1c0fdca6e3d1fbb8684224608690141c436fd63e30b0e89504224ef484909369859a5af436b47c775d85e5532c618c
- SSDEEP 24576:XAHnh+eWsN3skA4RV1Hom2KXMmHaJqL08fAAW5:Kh+ZkldoPK8YaJqLJfAR
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext