General
-
Target
61b9f5a1e4ef18ed559b55f51d5c17b51c90c9a75fb5f6523b6243ae2f5bf70c
-
Size
813KB
-
Sample
241017-bgx6cstdrc
-
MD5
08939a7fe1905c0c6e321e4e2cd90cad
-
SHA1
c463953c5f52e9bc0137513d69aa9294d84bde75
-
SHA256
61b9f5a1e4ef18ed559b55f51d5c17b51c90c9a75fb5f6523b6243ae2f5bf70c
-
SHA512
4cd3877461ae15143636fff08dc3dec2587451b45dc32857a5bc0dde53068f0b76158eb0e1519f401b93bd4e1c3e6c73144c83b9d59d406d8c0f011b4211e19e
-
SSDEEP
12288:+WB3yuZG8+De1kIse8LRWjrZCollIoNE8kgZu3pvK541rR:+WB3yuZGVteKRyjl6ikyCpvy41rR
Static task
static1
Behavioral task
behavioral1
Sample
61b9f5a1e4ef18ed559b55f51d5c17b51c90c9a75fb5f6523b6243ae2f5bf70c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
61b9f5a1e4ef18ed559b55f51d5c17b51c90c9a75fb5f6523b6243ae2f5bf70c.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.aminhacorretora.com.br - Port:
21 - Username:
[email protected] - Password:
_yA=,M5*J?KH
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.aminhacorretora.com.br - Port:
21 - Username:
[email protected] - Password:
_yA=,M5*J?KH
Targets
-
-
Target
61b9f5a1e4ef18ed559b55f51d5c17b51c90c9a75fb5f6523b6243ae2f5bf70c
-
Size
813KB
-
MD5
08939a7fe1905c0c6e321e4e2cd90cad
-
SHA1
c463953c5f52e9bc0137513d69aa9294d84bde75
-
SHA256
61b9f5a1e4ef18ed559b55f51d5c17b51c90c9a75fb5f6523b6243ae2f5bf70c
-
SHA512
4cd3877461ae15143636fff08dc3dec2587451b45dc32857a5bc0dde53068f0b76158eb0e1519f401b93bd4e1c3e6c73144c83b9d59d406d8c0f011b4211e19e
-
SSDEEP
12288:+WB3yuZG8+De1kIse8LRWjrZCollIoNE8kgZu3pvK541rR:+WB3yuZGVteKRyjl6ikyCpvy41rR
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-