General
-
Target
11092024_1550_10092024_OC_7001628119_7068059988.7z
-
Size
576KB
-
Sample
240911-s93pzszang
-
MD5
5b0885362dd2588c25184a258b86728a
-
SHA1
4d9b6a7c63cadab01892572b30a1f21ec8891d2a
-
SHA256
5137e8dc996f239ed7db718d1a1e0eb8102e70cbb02251205c1f51430a8dda5c
-
SHA512
54bacec0a92681d38f4362d9cd6a428b01f7509d7c03292536cc0b52309f1c34e7ffdf36fd345d32a43593fc0000f91e9b68accd928cf5eabf3baa36c7571c27
-
SSDEEP
12288:qYCIuRfuzEHJDx+p3fqkchQ6bvNcy7PBE1Gjl6gZhl4V2+SwFQ4jraoYbsc3PQ:qCEuzEpDwpAhXRPBEU8YIU+Swi4jBysh
Static task
static1
Behavioral task
behavioral1
Sample
OC_7001628119_7068059988.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
OC_7001628119_7068059988.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.stingatoareincendii.ro - Port:
21 - Username:
[email protected] - Password:
3.*RYhlG)lkA
Targets
-
-
Target
OC_7001628119_7068059988.exe
-
Size
1.0MB
-
MD5
cf702544b48bbe770375eb7188464eb8
-
SHA1
d19daad1628bccb94b5e5cbea08310231def8d99
-
SHA256
c40c36978fc01bcbd7eca78bb7b5689b7460bbe7ef122cc2a2cde6fc415d24e0
-
SHA512
0461297a310f67479c6d9195c25ea4559728b7ac78d3120dc689511373880a2800cef45b960b7d4b5fd23b87c0254ef7e139197d12e0af55b6b07759c9822192
-
SSDEEP
24576:Q4lavt0LkLL9IMixoEgeadFnfJgV3q9MmCS:Hkwkn9IMHeadpRgpaPCS
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-