General
-
Target
b4b045a39da0b2d38940085d78d1ab14.bin
-
Size
590KB
-
Sample
240609-ezf7caec52
-
MD5
25ef44dd3d08c4bf00c84604c9fff363
-
SHA1
d6e0eefca3b6d4b40db33d89fde2492410585c08
-
SHA256
07e799a8194569a9c13ba0840530a3ab652af155b979fc59d29ad7cf3ac020ee
-
SHA512
623d070147b5c8d941e12b6ed78b2d6448b2a2e26ae441487841cfda97596ca5b0958ece8a649d352df3863dfbe9ad2c72559051880d7a9e3dabb9d1078569aa
-
SSDEEP
12288:ig+fCZ6zIB9r00Wph1DhNimTJXlpacabIKqM7/rUY1R4qV:il6Z6z10ahlhNigJX/vabI5qDUGqqV
Static task
static1
Behavioral task
behavioral1
Sample
0477d366c3dce1723cf124fc263a85654b4454909dffcc0d325020f1187e4f34.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0477d366c3dce1723cf124fc263a85654b4454909dffcc0d325020f1187e4f34.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$ - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$
Targets
-
-
Target
0477d366c3dce1723cf124fc263a85654b4454909dffcc0d325020f1187e4f34.exe
-
Size
602KB
-
MD5
b4b045a39da0b2d38940085d78d1ab14
-
SHA1
2678aa772b284a12488e7abdb5c9bab76a0bd9bf
-
SHA256
0477d366c3dce1723cf124fc263a85654b4454909dffcc0d325020f1187e4f34
-
SHA512
e2a13b0b7bfaf3c3a02672425de6a32d87e0a0cdb7c6439ba91bac53429d420ce602ac3654216add8ccf416ba58688388667233c2144941c07cfc318e8c35184
-
SSDEEP
12288:78ALbFN7nwPgrUd+N2qUouxL/8YpOrbW1wEW9XGGc5S0xquGjk+kJhDd:LLwIrw+oq9uxT8sOrbW1wEQXOS0RXd
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-