General
-
Target
BESTELLU.EXE.exe
-
Size
917KB
-
Sample
240625-mz4xeavgra
-
MD5
2fac53d4021b54c213978d42c3969f69
-
SHA1
9f9fdbeba0d6b5552b79379f5223f8a835852b8e
-
SHA256
79b65ff6fce04514c36a1bd5290f8a0d71646a9a634714cd3fa35f7c0f7835ce
-
SHA512
694f6cd20b9255245edc4be0b900f7373e9969872da5c5920df97d9aaa25adc9643e70c50e6d3575e78009e8889de3d8168efeaf6d3c81a812604dc20692e17c
-
SSDEEP
12288:9HGT9ip/w75fpEWSuMtbWl+E7ZgTqDxNhkHTn7QCeHTISfpxrtD8:iRJSuMgl+JTP7QRJtD8
Static task
static1
Behavioral task
behavioral1
Sample
BESTELLU.EXE.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
BESTELLU.EXE.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.rusticpensiune.ro - Port:
21 - Username:
[email protected] - Password:
hr,d@KUwa5llI%*RNL^J]g%8I;!;_Ne#G1h~lE!*86DAAD6#iLm$x)r+e1z$p+_Q,4_(f!};B?vD!IG?NqT[zOHNr6_nww[S]V?MlcYSt_QO
Targets
-
-
Target
BESTELLU.EXE.exe
-
Size
917KB
-
MD5
2fac53d4021b54c213978d42c3969f69
-
SHA1
9f9fdbeba0d6b5552b79379f5223f8a835852b8e
-
SHA256
79b65ff6fce04514c36a1bd5290f8a0d71646a9a634714cd3fa35f7c0f7835ce
-
SHA512
694f6cd20b9255245edc4be0b900f7373e9969872da5c5920df97d9aaa25adc9643e70c50e6d3575e78009e8889de3d8168efeaf6d3c81a812604dc20692e17c
-
SSDEEP
12288:9HGT9ip/w75fpEWSuMtbWl+E7ZgTqDxNhkHTn7QCeHTISfpxrtD8:iRJSuMgl+JTP7QRJtD8
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-