General
-
Target
Ödeme onaylama.tgz
-
Size
1.4MB
-
Sample
240704-m3cbkayblh
-
MD5
ef42530db6091852e5918557d297ddbc
-
SHA1
0b2eaa41e9419bcfe287ad19a4d3215e83aad34f
-
SHA256
3aeff36bc501e1e6367152406d63cfb752cc8a4a6fbe971f17123d744f01cfaf
-
SHA512
74d2d7d03add4ccbcbb83829fbfcfea4f33995ca1e225c54765e586237d0a77f1a6bd7013feb1c1cffce78f12650597b580479f82a3b8c469ba3f65582066bf6
-
SSDEEP
24576:bcKTd2/ljYlxngF3Gs/rV/LVqFsftvqVEwuy1H80Y+ad/hD7FcZ3kK9F0:ACMtj4wW7OvqRuQc0Y1J7FQ3kK9F0
Static task
static1
Behavioral task
behavioral1
Sample
Ödeme onaylama.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Ödeme onaylama.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot7154232398:AAEprpSrKtvK17zgH_6Ak0foVI7qtth3csI/
Targets
-
-
Target
Ödeme onaylama.exe
-
Size
3.0MB
-
MD5
4b6fa254293a7c473d738967ee1949f4
-
SHA1
8b57e250cb8829b85d0370e81b2a2595c55398e6
-
SHA256
4ff52001ba6ad7e84ea1f6f24d895b3e8705d9bc7ee5afbcf09f8a2855c1c50e
-
SHA512
10436d797c8aee650dd476694410666491ba046d7c2e00c951747cde404d435acac38d23e43a1bbc51c4a3914a958b041b274d345d34a9a29baef0f8d276bceb
-
SSDEEP
49152:V77LvQE87W0HWTKM4T1gFFVhDHCXuzkw:FOu+u
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-