General
-
Target
03102024_0504_02102024_SCV6239027-FLPEW828938-X2YUSJPPID20DK.7z
-
Size
773KB
-
Sample
241003-fqp9bswcrn
-
MD5
9dfea264a9eac53e1a71e59bbc4c1854
-
SHA1
2bd7b7de851cab58c6dee7d4ece04fedc366d706
-
SHA256
b20ce2f8995b51bdd0d67bc7e740ce603fe6e15022a977039e28293c4cb49f18
-
SHA512
b626c1d0cb0112f790b8717afec72ea7f7c96372b72957e73fb695e1aa8010593f972cd16f5d730800c85e372b1ab8bdd55b93b574d6a1962a268139ac270f67
-
SSDEEP
12288:vYX+r4VnNvMlKwO559J/IzhD4SGUaUO6XGkJcHTONBVJx9Q5AYX5K/Ev/S38+wIe:4VNvMlkJAzxJS8jJPQ5AI58Ev/hhsxm
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
@qwerty90123 - Email To:
[email protected]
Targets
-
-
Target
SCV6239027-FLPEW828938-X2YUSJPPID20DK.exe
-
Size
1.1MB
-
MD5
28be5ae70b28131aec30c2eee96f892f
-
SHA1
b09f19cca8d7bab1a95b07b304f18258840efb67
-
SHA256
5e61b6c0dda4a59df66175b06b7ead8d2409a4723d5d65b25d262720eb1a4969
-
SHA512
a423e3bc9cb821b64c1f22e703342d7b098db196fd038c37d7593d1212e749a85ee030b48a25ce54a0caeed8a2048962756b44014225ed9d407f46e00dcbf6fe
-
SSDEEP
24576:8fmMv6Ckr7Mny5Q/uH9ZLx5/SGpTJAlXwjK8:83v+7/5Q/uH9Z9nlOwt
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-