General
-
Target
0542bac9a3c8fb1ba3da78d0b003f4b77004810d39631f261801cd88fbcccab3
-
Size
658KB
-
Sample
241119-kzh9latenj
-
MD5
d54fe74b449b3f275b2faa8173e61c15
-
SHA1
ac7945efbeecfce2fcab355eac06003cd50ce1ea
-
SHA256
0542bac9a3c8fb1ba3da78d0b003f4b77004810d39631f261801cd88fbcccab3
-
SHA512
fb4f9c76d99c6a5f7bd580248fc73d924475ffe3a3364a443ce18becd75a976c746777990b63153efe0175012b0bf2d05fe95040a2116d6af22197fe5801ac38
-
SSDEEP
12288:C/V8g5IfeLhGrVjXEysp2O887ZbgxJQkhF2TvmRrv17K9IJKmC82RtK+LxD89WNH:C98YoeLhG5wX087ZIJQkgMv0hmV2q+LN
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
zqamcx.com - Port:
587 - Username:
[email protected] - Password:
Methodman991 - Email To:
[email protected]
Targets
-
-
Target
18112024_Doküman_1 Kasım 2024- Avans_T24-2112184_dekont.exe
-
Size
1.2MB
-
MD5
c559b0a76b256e3537598031eaf17c34
-
SHA1
3d079a42ee7110ec7389bb4b28bd572a8244bf52
-
SHA256
08e931e2b4a954a57c72df289fbe2e4971a912e453b71f19d1859f1a350f9fba
-
SHA512
4b8a8bf9ca6a6d41bc35a59beb056a578aeba82b8735ffbdde92cae3f360f36187dc6953f3e2eab410ab7798d87c4e52371bc1cc426e366c80bbc728b6fba9f2
-
SSDEEP
24576:Atb20pkaCqT5TBWgNQ7aB4h0vmxQqfgy6A:JVg5tQ7aB4GQh5
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Suspicious use of SetThreadContext
-