General
- Target b61ac5944e5ea917cdfafc56beff6b0c14c073aea71336f939bae1a7bb432106
- Size 2.3MB
- Sample240611-cbhddszcnb
- SHA256 b61ac5944e5ea917cdfafc56beff6b0c14c073aea71336f939bae1a7bb432106
- MD5 39b87e27d213375bb5c94cf386a6aaf5
- SHA1 8ff9e7355ad1691a675dc0e86686266fd509d4d6
- SHA512 20f168eadf44aa82efb6ded020310b0a8cd215cc86c2c86c4fb53620921ecb70dd14756b542d0fba06862ddc3cca76d471b7c7590a87c232c356bed9d7438657
- SSDEEP 3072:LnJX2tdtyOHWZV59Sr8wv+mI8UYQw4eY1ZVyd/BRfFglJhlwYxveNwa9KqwX9Tp2:LnJ0
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b61ac5944e5ea917cdfafc56beff6b0c14c073aea71336f939bae1a7bb432106.exe
Resource
win7-20240508-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
b61ac5944e5ea917cdfafc56beff6b0c14c073aea71336f939bae1a7bb432106.exe
Resource
win10v2004-20240426-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
ftp
-
Host
ftp://ftp.normagroup.com.tr
-
Port
21
-
Username
-
Password
Qb.X[.j.Yfm[
Targets
-
- Target b61ac5944e5ea917cdfafc56beff6b0c14c073aea71336f939bae1a7bb432106
- Size 2.3MB
- SHA256 b61ac5944e5ea917cdfafc56beff6b0c14c073aea71336f939bae1a7bb432106
- MD5 39b87e27d213375bb5c94cf386a6aaf5
- SHA1 8ff9e7355ad1691a675dc0e86686266fd509d4d6
- SHA512 20f168eadf44aa82efb6ded020310b0a8cd215cc86c2c86c4fb53620921ecb70dd14756b542d0fba06862ddc3cca76d471b7c7590a87c232c356bed9d7438657
- SSDEEP 3072:LnJX2tdtyOHWZV59Sr8wv+mI8UYQw4eY1ZVyd/BRfFglJhlwYxveNwa9KqwX9Tp2:LnJ0
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext