General
-
Target
f6158b88891d92019097e2f73dcb6f705bbb8194ee7d14c3ff74c4e145ea1e6a
-
Size
619KB
-
Sample
241017-bv1teayaqm
-
MD5
ad688c10bfdda820bb5f7b850f7f658e
-
SHA1
b35984dd85664fc350f1f85e8322883f105db504
-
SHA256
f6158b88891d92019097e2f73dcb6f705bbb8194ee7d14c3ff74c4e145ea1e6a
-
SHA512
41d11eeb4f5414d02ae37ee401f630048a3b3d98020be85b7b7acc38471e0faf82f5eff49f367a164ee7ed8f8d20bc06dcfafe3b16cc3942bcd37df898cf6b8d
-
SSDEEP
12288:DLmr5i4rQ3D14i7VUbAuLh90QzokA6zLkJCzUi9iMSV+0JjmjL6IzmZbfP28jOaz:DLuhri14i7msuj0ONwMIi9iMSVpExWbr
Static task
static1
Behavioral task
behavioral1
Sample
Rozprawa sądowa zaplanowana na 25 listopada 2024 r., godz. 1130 T14040024.971.doc.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Rozprawa sądowa zaplanowana na 25 listopada 2024 r., godz. 1130 T14040024.971.doc.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.aminhacorretora.com.br - Port:
21 - Username:
[email protected] - Password:
_yA=,M5*J?KH
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.aminhacorretora.com.br - Port:
21 - Username:
[email protected] - Password:
_yA=,M5*J?KH
Targets
-
-
Target
Rozprawa sądowa zaplanowana na 25 listopada 2024 r., godz. 1130 T14040024.971.doc.exe
-
Size
813KB
-
MD5
08939a7fe1905c0c6e321e4e2cd90cad
-
SHA1
c463953c5f52e9bc0137513d69aa9294d84bde75
-
SHA256
61b9f5a1e4ef18ed559b55f51d5c17b51c90c9a75fb5f6523b6243ae2f5bf70c
-
SHA512
4cd3877461ae15143636fff08dc3dec2587451b45dc32857a5bc0dde53068f0b76158eb0e1519f401b93bd4e1c3e6c73144c83b9d59d406d8c0f011b4211e19e
-
SSDEEP
12288:+WB3yuZG8+De1kIse8LRWjrZCollIoNE8kgZu3pvK541rR:+WB3yuZGVteKRyjl6ikyCpvy41rR
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-