General
-
Target
6d90dba4f288026e3b494e63ff2ca0e68219ad380fad14be8d7cb4314bc02a0b
-
Size
601KB
-
Sample
241211-bjxydayjfw
-
MD5
acc45c355c1aad8206fd3d7187360a22
-
SHA1
374f5fa69247b7053dfad17b05b7005ee00e1138
-
SHA256
6d90dba4f288026e3b494e63ff2ca0e68219ad380fad14be8d7cb4314bc02a0b
-
SHA512
4ce4bd5a30f75ae38c1259966b70240a05bf517c7ac6e52669b6b30a4de0a0b0b15bba9cdf229607c6d2ad0fb6fcc697399ab14a775db0c08d990dd5270c2477
-
SSDEEP
12288:nhH67sVxIUo3/cP4hF8mOHzhd/WzZ5C/2NY7qqDatpCwJ0oEhSEVPi:nha7MIn30whxgzhd+zZhKOCs0TgYi
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
cy+G_(979n9N - Email To:
[email protected]
Targets
-
-
Target
Pay5637002881-Sf7w9shs9w90-lxysui.exe
-
Size
1017KB
-
MD5
a4aca3a3f0ed567d0be602f90f230abe
-
SHA1
ea658b1610542d078b4a6594c4cdbf4db4acc38f
-
SHA256
0797ece0fc2a16bd36c4b921f3e7828f4cec603cc37ed7f708ea4f56bdf4d9f9
-
SHA512
83d361a8e51030740bd2ae8708dd0ddb78ab4f112d069a5b2bad733f8dc0aef53ec1864ae847282973b48950b8d1e3f8f0cae5eb804423f0579888feeabf040b
-
SSDEEP
24576:Qu6J33O0c+JY5UZ+XC0kGso6Fau6me0opjWY:au0c++OCvkGs9FauPeyY
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Suspicious use of SetThreadContext
-