General
-
Target
PT20240624001.PDF.rar
-
Size
559KB
-
Sample
240625-kcz9layfje
-
MD5
fc28d8a86c339665fb9522788ad4ec51
-
SHA1
12c368c497421266a5468bb62e14dde34ec6a227
-
SHA256
9887a36afe2db4889ed24e9b327fc8486b48c8e40a4362c059cad903828144af
-
SHA512
0e6d9d348a5629aaaa87e52f4c79733f185a6dc29898dfa593e1151e1e91547b4054ee2234747eea5c22af8186e7bbf942257bd2f7d3132dc224ad9c63c81c73
-
SSDEEP
12288:Qz7cHJx+67qY3aLjvLuzzcfY6wZxVM1f+nCCReDkrcx5KTHhccw5H5:Qz7cpxl7qYmTLuzzIY3ZUf+n5ReDkrq/
Static task
static1
Behavioral task
behavioral1
Sample
42.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
42.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.funworld.co.id - Port:
587 - Username:
[email protected] - Password:
fwp123mail - Email To:
[email protected]
Targets
-
-
Target
42.exe
-
Size
1.1MB
-
MD5
46dcf1cabaebbae61472fc0151dea92b
-
SHA1
ab1bcd43847039ae8ce9f28a8bec60ae0219b3b2
-
SHA256
eedfb4aa8784f4f2b221e4e3ab6058045a6575b8f4ee0f33d03c2dd93a8f7789
-
SHA512
81d7fc7f294001bb74bfaff2664dc4f727e33ff2ec30a068aa43baeb50563196ea2a4c3d271027c1befbc0d0f1e317d2faa7e506c1ff23e4cf90cd3ce608fe81
-
SSDEEP
24576:sAHnh+eWsN3skA4RV1Hom2KXMmHaxGqlaRXfoZ+2o1+5:Lh+ZkldoPK8YaxGSqAZIG
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-