General
-
Target
a3f0d089349438744b27a32c115b8dd48b4db70cb6a7d6a001eddcf88c989c2fN
-
Size
799KB
-
Sample
241001-sgb2kawajl
-
MD5
b406e34116b0647d85110b739aa97080
-
SHA1
96c16395dea34e430d649c03abad30ef43970c62
-
SHA256
a3f0d089349438744b27a32c115b8dd48b4db70cb6a7d6a001eddcf88c989c2f
-
SHA512
24950197c3da90264181bba5f366522aa767dbd8a1ea09d3175e393e2ed11b41dd82dd0cb75c699c486a936bd4e18256bd75c34d4c6231f29e8d6421e4bcb87c
-
SSDEEP
24576:KTd82SXRRIyaQ6aw7lUESJVufn/VgvVY:CXSBgOQzSr
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
webmail.anagennisi-sa.gr - Port:
587 - Username:
[email protected] - Password:
Smiliotopoulou - Email To:
[email protected]
Targets
-
-
Target
a3f0d089349438744b27a32c115b8dd48b4db70cb6a7d6a001eddcf88c989c2fN
-
Size
799KB
-
MD5
b406e34116b0647d85110b739aa97080
-
SHA1
96c16395dea34e430d649c03abad30ef43970c62
-
SHA256
a3f0d089349438744b27a32c115b8dd48b4db70cb6a7d6a001eddcf88c989c2f
-
SHA512
24950197c3da90264181bba5f366522aa767dbd8a1ea09d3175e393e2ed11b41dd82dd0cb75c699c486a936bd4e18256bd75c34d4c6231f29e8d6421e4bcb87c
-
SSDEEP
24576:KTd82SXRRIyaQ6aw7lUESJVufn/VgvVY:CXSBgOQzSr
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-