General
-
Target
da3762f33ed7899b5febc3a5e5796bf5486dd22eb052e4e61ecaffcd8da09b69
-
Size
574KB
-
Sample
241120-bp2thssjfl
-
MD5
e716de1b25a99a0ce0907bd5f78048b1
-
SHA1
33ea5eca45a78dd2dfefc17d3da1e559ce5a9eee
-
SHA256
da3762f33ed7899b5febc3a5e5796bf5486dd22eb052e4e61ecaffcd8da09b69
-
SHA512
629984d21ef9a6258b6b287d1538c60ddf0e05af13f9467497be0ce1d908ce4887d1f64e2f914884d8b940c54ab242970e6780653b560e9fc655340df6eb93ff
-
SSDEEP
12288:ie97d+JMMDBYCIggSnDbh80Na550/C6bRkhnfv6uFDl1mUAHZFu:nH+JMBoDbtS5YC6byhKu/09I
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
cy+G_(979n9N - Email To:
[email protected]
Targets
-
-
Target
Pago_57670257u8_9035y6u707889SDH79.exe
-
Size
90.0MB
-
MD5
1745ee7069c612e977e1695891355c87
-
SHA1
6bfab296b70272474b3745cbc339b7a95e1b468f
-
SHA256
ae729256a89999262e56c6192422dfe736f23f94136a1803b9a5a7778bed51c9
-
SHA512
a46ae55df42dc82b886cc6eb8bca63d17a0b95d01b2a655b45d2d88890b897f0d01e7a93c622303abcb0ab6355f0507e6afd3ea3d5ae48d7cd66411fc15d67ea
-
SSDEEP
24576:6tb20pkaCqT5TBWgNQ7a3B7GQUMfVEkC6A:nVg5tQ7a3k7gC5
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Suspicious use of SetThreadContext
-