General
-
Target
Zaplata.jpg.img
-
Size
1.2MB
-
Sample
240617-wcdalssapp
-
MD5
1f0357047217a540767f21466dd5ab66
-
SHA1
c30fb230004f53cfea793824676df56ddd8fb272
-
SHA256
0343b65d72d6de7e249af0cdf3c5531982b1aac457a758bf2948bd56a2cd63e9
-
SHA512
750b20afcf522bf9cd2bbae961cb6722eb5f4e6e53f9a9672426cc0257eb29dc245b5bdea23f86a7fd7f0a8a5d758c0a7faefe2bea7115f163c477db38274390
-
SSDEEP
12288:kuFFZ6BKGu3ZAJ7ECGVEJIhlu4gvSD3tYE/B:F6BKGW+EV+/4bYE/
Static task
static1
Behavioral task
behavioral1
Sample
Zaplata.jpg.iso
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Zaplata.jpg.iso
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
out.iso
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
out.iso
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
Zaplata,jpg.exe
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
Zaplata,jpg.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.as-print.pl - Port:
587 - Username:
[email protected] - Password:
HURT1985asprint - Email To:
[email protected]
Targets
-
-
Target
Zaplata.jpg.img
-
Size
1.2MB
-
MD5
1f0357047217a540767f21466dd5ab66
-
SHA1
c30fb230004f53cfea793824676df56ddd8fb272
-
SHA256
0343b65d72d6de7e249af0cdf3c5531982b1aac457a758bf2948bd56a2cd63e9
-
SHA512
750b20afcf522bf9cd2bbae961cb6722eb5f4e6e53f9a9672426cc0257eb29dc245b5bdea23f86a7fd7f0a8a5d758c0a7faefe2bea7115f163c477db38274390
-
SSDEEP
12288:kuFFZ6BKGu3ZAJ7ECGVEJIhlu4gvSD3tYE/B:F6BKGW+EV+/4bYE/
Score3/10 -
-
-
Target
out.iso
-
Size
1.2MB
-
MD5
1f0357047217a540767f21466dd5ab66
-
SHA1
c30fb230004f53cfea793824676df56ddd8fb272
-
SHA256
0343b65d72d6de7e249af0cdf3c5531982b1aac457a758bf2948bd56a2cd63e9
-
SHA512
750b20afcf522bf9cd2bbae961cb6722eb5f4e6e53f9a9672426cc0257eb29dc245b5bdea23f86a7fd7f0a8a5d758c0a7faefe2bea7115f163c477db38274390
-
SSDEEP
12288:kuFFZ6BKGu3ZAJ7ECGVEJIhlu4gvSD3tYE/B:F6BKGW+EV+/4bYE/
Score1/10 -
-
-
Target
Zaplata,jpg.exe
-
Size
561KB
-
MD5
6f9e931132ed53e111a1d022395a5b7d
-
SHA1
aba94805466d7a2ae0f5be485d3f9930430e1f4b
-
SHA256
c5425d62c01551e1c243ed453bf14d0b51ad7e890d59ef469c5b9418bb6361a0
-
SHA512
45c40fd55594f99bd120f5f150f9dca8e59147f8407d5270464d122a7aa7385d42dcfde721fa931ad7b9cc32ce076e3e037d14bfda7e8149375dfa8b1d1f0c0b
-
SSDEEP
12288:OuFFZ6BKGu3ZAJ7ECGVEJIhlu4gvSD3tYE/B:76BKGW+EV+/4bYE/
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-