General
-
Target
b23c688b0effc54ce5a9e30a2532f25362f5563e58bd529a7d72dfb64249aa64
-
Size
663KB
-
Sample
240917-l5jb8axdnr
-
MD5
d270e880b7b2fe73810a807caed3a5fb
-
SHA1
b0e0fa1c1f5462a6944a6a5b77d195110053b686
-
SHA256
b23c688b0effc54ce5a9e30a2532f25362f5563e58bd529a7d72dfb64249aa64
-
SHA512
aef99430073c8bcc6f73ac84d0f74df16575ed1147dbff215734efbc6e5e02ef813d06b6730ec253e8c32535f4479819308d434b15d80ba21a41e1db5e99ba66
-
SSDEEP
12288:FXH8QIcSnGGZtaQPVv/wm4OJys9xZA4xDZJbrKnMYZ1+gnjlwCXXO6X:GQIcSntvVvv4my4Z1jA7njGCXhX
Static task
static1
Behavioral task
behavioral1
Sample
462d52d82377841b63ebcf43f25772edb2a761c559be9d28a510c0ab7155d2c1.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
462d52d82377841b63ebcf43f25772edb2a761c559be9d28a510c0ab7155d2c1.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
tank576$%)&** - Email To:
[email protected]
Targets
-
-
Target
462d52d82377841b63ebcf43f25772edb2a761c559be9d28a510c0ab7155d2c1.exe
-
Size
1.1MB
-
MD5
96f60e7b370e3f1886ff83c067312108
-
SHA1
b1e275bc665b436180a81e1c631118a92fa628db
-
SHA256
462d52d82377841b63ebcf43f25772edb2a761c559be9d28a510c0ab7155d2c1
-
SHA512
a78d9ef2fbfcab228572de7fa1f65511b4f38c98c73fd0f194fc851fc9eaeec1597b1c687f40c9b80a3af2a09b92ea8ec8eef53b460e9ff076743d3dc91a0e01
-
SSDEEP
24576:j4lavt0LkLL9IMixoEgeacCRMTCcfEXq4PeGxq9MmCS:2kwkn9IMHeacCRMTwxaPCS
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Suspicious use of SetThreadContext
-