General
-
Target
431d6d53bcdb53dc59f11efda8bfaab05c17e02eb8280aec9b6b4e0170939e61
-
Size
560KB
-
Sample
241120-bqg6haxkhx
-
MD5
82a3f959619d0159a539e8c6e58ebaa9
-
SHA1
fbd9d45ff07565077ba80e395ac48060baebfa2d
-
SHA256
431d6d53bcdb53dc59f11efda8bfaab05c17e02eb8280aec9b6b4e0170939e61
-
SHA512
30db467739c10506efacef6792a1b36c61cfd467d44f07e37510cadb68cfde60d472f23770e77b4026608329f07baedf412f2d96b766e9e05c2281df1bd5e9ee
-
SSDEEP
12288:TqHgIqugt5V6QbqCiYlsVk8edUlhTccq3jddgz315:2AbBb8YKLh8xGj
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
cy+G_(979n9N - Email To:
[email protected]
Targets
-
-
Target
Cotización-57782789988-RFT799O087890-.exe
-
Size
1.0MB
-
MD5
a61f9e743911a7b615443051919bd1a8
-
SHA1
e53973a5f6bc88090928e6830b728e162f564cb5
-
SHA256
9eddd11bccf08dd156d1f5d9624a9e5c3c9907b9284deee8a935f85c710aa71a
-
SHA512
9a095a76e4ce4ee3b8bcf6f500f866d67e7be8479d4b3484bda7a61708f76b377c9965a73c0bea26d2a873cc80993a6c989e657cb97553638323e0662be26997
-
SSDEEP
24576:btb20pkaCqT5TBWgNQ7av4rHnsKMFXL6A:YVg5tQ7av+HnsKMFb5
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Suspicious use of SetThreadContext
-