General
- Target e6e1eff3262c8fb9b045adbf949140a831a425c3138b2d215b03295b555b1bec
- Size 769KB
- Sample240611-cd8clazdmf
- SHA256 e6e1eff3262c8fb9b045adbf949140a831a425c3138b2d215b03295b555b1bec
- MD5 a5deda0c4f27fc4b871cf01ea99a19a5
- SHA1 a1f0c912f6baaba3db830c956fe1fe369ed01a28
- SHA512 5946b008d579fca1bb9c61bf7ca75c4a5c6aec6aaac3dadac18ecca23040ecd66ce864ec1e01045913b477ae9bec083b3593cf5e7cd860f333786f5809341afd
- SSDEEP 24576:SFdVPOF1Y9VydarGUp3P7oHBA/uHgThAr:S3a1Y31G+3jRThAr
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
26640240020_Dekont20240607_3662553.exe
Resource
win7-20240419-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
26640240020_Dekont20240607_3662553.exe
Resource
win10v2004-20240426-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.blancahotel.com
-
Port
587
-
Username
-
Password
J4OsTW6J
-
Email to
Targets
-
- Target 26640240020_Dekont20240607_3662553.exe
- Size 2.3MB
- SHA256 040a64aa1109fd85e06d523bd7f78abd8d895329eb0e50605861a769e0277cb5
- MD5 bebbe9d337d411a7d7718d539ed2df29
- SHA1 09641a33c9751575425bd980bd5ee6695ead3fc7
- SHA512 c9bbe55051df35ad89b54175559560fb9d010c55e7f9219f3b4eeee98b768c374a59797f22adbca00dae2aba25d1f093045d15ff894df2a2d7effd68aa9c60a5
- SSDEEP 3072:hnJXhEduoz6TeqBeTtme9KxbDgqc0vjGQCkqQthaEgMXooudQr8JkgzUBdp/VcWa:hnJycb
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext