General
-
Target
7b69ba88f5f592316ca1c50d522a7be12a81c401745831abf252db99e5d2b2c9
-
Size
619KB
-
Sample
241017-b1xnyaydqn
-
MD5
1148e16bf19a8f7d008d5ac56740fe3c
-
SHA1
89cf0583daea041f1ea6407dc3fb24635ee7edd0
-
SHA256
7b69ba88f5f592316ca1c50d522a7be12a81c401745831abf252db99e5d2b2c9
-
SHA512
84075f5e1d11890089aab8e6abc6a0b17017e8f2129c17aa3730893d866bc4b3e84fdd41a1cef4512afc5ccb58199191030c26cb08c04fe7854daca8dbe85b3e
-
SSDEEP
12288:5W++v/0OyoebAPnRXTxfzKyuLhN9AYhhvCRFvL0yoj/Si8xjfz52:MsYnlpzKyuf9AYhhvCf0yLjf4
Static task
static1
Behavioral task
behavioral1
Sample
лист № 2024-10-16T14040024.971.doc.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
лист № 2024-10-16T14040024.971.doc.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.aminhacorretora.com.br - Port:
21 - Username:
[email protected] - Password:
_yA=,M5*J?KH
Targets
-
-
Target
лист № 2024-10-16T14040024.971.doc.exe
-
Size
813KB
-
MD5
d434a55b2bcc180275cee1074574b2b2
-
SHA1
9dddac47b0c412d3d8ed0b7f284709d9fb0ba800
-
SHA256
266d27c5127a35ce1beff1de731c147b95e3d954afbb20c93308bacf3ff63dc2
-
SHA512
df75ee7fcac05792fe3b2f1bf51f8a1eff1c06c6df66da9e708d5c07a93460b39255812517fe0b27cae5e26a2b7935189c725733767187decbe75d85d3512c22
-
SSDEEP
12288:SSa3yuZG8+De1kIse8LRWjrZCollIoNE8kCZu3FvK541r3NT0:SSa3yuZGVteKRyjl6ikcCFvy41r3N4
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-