General
- Target ss.exe
- Size 1.0MB
- Sample240715-eryfnazfld
- SHA256 7ca9c170757e7f0f9092fcbef7d2830c2393373bdd00648e76e3437ca5a2169f
- MD5 b21f492bb760c34ba26a70a9a2950eb0
- SHA1 a4f3143b16bffe33e23f788a8e385ef9bc4bd819
- SHA512 6f17907e6780e2d3bead848135e04aa4d6a9d2ecb5e18f46d23f1748db9c7909a0032ddb593c7123943c2047e196e5abe96420d675a223b64747fc2877a4e94b
- SSDEEP 24576:pAHnh+eWsN3skA4RV1Hom2KXMmHanTNEDbsRwNL5:wh+ZkldoPK8YanQb/
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ss.exe
Resource
win7-20240705-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
ss.exe
Resource
win10v2004-20240709-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.pgsu.co.id
-
Port
587
-
Username
-
Password
Vecls16@Vezs
-
Email to
Targets
-
- Target ss.exe
- Size 1.0MB
- SHA256 7ca9c170757e7f0f9092fcbef7d2830c2393373bdd00648e76e3437ca5a2169f
- MD5 b21f492bb760c34ba26a70a9a2950eb0
- SHA1 a4f3143b16bffe33e23f788a8e385ef9bc4bd819
- SHA512 6f17907e6780e2d3bead848135e04aa4d6a9d2ecb5e18f46d23f1748db9c7909a0032ddb593c7123943c2047e196e5abe96420d675a223b64747fc2877a4e94b
- SSDEEP 24576:pAHnh+eWsN3skA4RV1Hom2KXMmHanTNEDbsRwNL5:wh+ZkldoPK8YanQb/
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext