General
-
Target
5f5f67223c5e5aa9378dac3056acff60fd6314aa34ace2e83806a1e9e9c7c5cc
-
Size
879KB
-
Sample
241124-bmzalssneq
-
MD5
b5c04403d74a461bd98765f7aa31cc85
-
SHA1
d325019136f69a7f69a774e6ba0d23dbc663d7c4
-
SHA256
5f5f67223c5e5aa9378dac3056acff60fd6314aa34ace2e83806a1e9e9c7c5cc
-
SHA512
98bc442e136a9e54d5e587dd4b13e8ef5f6c62d712a66b44bf7979d5a51f5acdf838b199475ae3789e0fecf6a1a5da3f4d690e8d23da249604ff2d313bcfbe06
-
SSDEEP
12288:nqUyBKvFqJFTPi4c8IKheIUlDsrdTkD4FUPKWXP998v96:L/vFqe4zHUlDewDbF998v96
Static task
static1
Behavioral task
behavioral1
Sample
5f5f67223c5e5aa9378dac3056acff60fd6314aa34ace2e83806a1e9e9c7c5cc.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5f5f67223c5e5aa9378dac3056acff60fd6314aa34ace2e83806a1e9e9c7c5cc.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.enerzi.co - Port:
587 - Username:
[email protected] - Password:
Enerzis@123!#
Targets
-
-
Target
5f5f67223c5e5aa9378dac3056acff60fd6314aa34ace2e83806a1e9e9c7c5cc
-
Size
879KB
-
MD5
b5c04403d74a461bd98765f7aa31cc85
-
SHA1
d325019136f69a7f69a774e6ba0d23dbc663d7c4
-
SHA256
5f5f67223c5e5aa9378dac3056acff60fd6314aa34ace2e83806a1e9e9c7c5cc
-
SHA512
98bc442e136a9e54d5e587dd4b13e8ef5f6c62d712a66b44bf7979d5a51f5acdf838b199475ae3789e0fecf6a1a5da3f4d690e8d23da249604ff2d313bcfbe06
-
SSDEEP
12288:nqUyBKvFqJFTPi4c8IKheIUlDsrdTkD4FUPKWXP998v96:L/vFqe4zHUlDewDbF998v96
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
AgentTesla payload
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-