General
-
Target
ee9f24180e58c655703bbc5ae747196f_JaffaCakes118
-
Size
349KB
-
Sample
240920-29be6stflr
-
MD5
ee9f24180e58c655703bbc5ae747196f
-
SHA1
b636aebd8ccb90287529c738701fb10ce797603f
-
SHA256
a89538eb67514a59db1306da423ab0ba3d261892df4fbb908943b867dd41f95d
-
SHA512
5bff30aa35e63937354cb9e7479137313b0913e78fec064de66d16cdc8b302e45435212ceb31ef396818add9e3259404085346de0bc8c9889f6219a6185e1d71
-
SSDEEP
6144:5H3nIn5hgl+OdIoXmw7OVhHiqpCqH9J5aonQRRq3YFK06QzmMhRQC0w2vd/6R:5H3In5al+OTmw7wQoCqH8onQ0YY06QXZ
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
Qwerty2020@@$
Targets
-
-
Target
Quotation MAK-2009-15-1 Turbine & Centrifugal Pumps.pdf.exe
-
Size
366KB
-
MD5
4359be59a0835b7e548eaf0095515710
-
SHA1
2929309853d9c0dc36de86c88c92cd4af6fb56e5
-
SHA256
954bbd9e612117e2fa3f8c71e72ca98461f7ec20fc028d9910f8629cd170ec2b
-
SHA512
6530cd13d234154426a5153c1d0798726d8648579fa04d0cd410d7094f673bac211fd9420fa91fd480f015f197f860f68c3af0eb1317d80c6780254122605c40
-
SSDEEP
6144:j0Sxpig6daiXufpZ+fOGeTscz+6O84XUl9MTsTGJcaAmob86XJ0uduWiT26Op:Xx7iXuf3+fOzsC+X8z0Py86+ap
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Suspicious use of SetThreadContext
-