General
- Target b4b045a39da0b2d38940085d78d1ab14.bin
- Size 590KB
- Sample240609-ezf7caec52
- SHA256 07e799a8194569a9c13ba0840530a3ab652af155b979fc59d29ad7cf3ac020ee
- MD5 25ef44dd3d08c4bf00c84604c9fff363
- SHA1 d6e0eefca3b6d4b40db33d89fde2492410585c08
- SHA512 623d070147b5c8d941e12b6ed78b2d6448b2a2e26ae441487841cfda97596ca5b0958ece8a649d352df3863dfbe9ad2c72559051880d7a9e3dabb9d1078569aa
- SSDEEP 12288:ig+fCZ6zIB9r00Wph1DhNimTJXlpacabIKqM7/rUY1R4qV:il6Z6z10ahlhNigJX/vabI5qDUGqqV
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0477d366c3dce1723cf124fc263a85654b4454909dffcc0d325020f1187e4f34.exe
Resource
win7-20240221-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
0477d366c3dce1723cf124fc263a85654b4454909dffcc0d325020f1187e4f34.exe
Resource
win10v2004-20240226-en
5 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
cp8nl.hyperhost.ua
-
Port
587
-
Username
-
Password
7213575aceACE@#$
-
Email to
Extracted
Credentials
-
Protocol
smtp
-
Host
cp8nl.hyperhost.ua
-
Port
587
-
Username
-
Password
7213575aceACE@#$
Targets
-
- Target 0477d366c3dce1723cf124fc263a85654b4454909dffcc0d325020f1187e4f34.exe
- Size 602KB
- SHA256 0477d366c3dce1723cf124fc263a85654b4454909dffcc0d325020f1187e4f34
- MD5 b4b045a39da0b2d38940085d78d1ab14
- SHA1 2678aa772b284a12488e7abdb5c9bab76a0bd9bf
- SHA512 e2a13b0b7bfaf3c3a02672425de6a32d87e0a0cdb7c6439ba91bac53429d420ce602ac3654216add8ccf416ba58688388667233c2144941c07cfc318e8c35184
- SSDEEP 12288:78ALbFN7nwPgrUd+N2qUouxL/8YpOrbW1wEW9XGGc5S0xquGjk+kJhDd:LLwIrw+oq9uxT8sOrbW1wEQXOS0RXd
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext