General
- Target OC & COA.exe
- Size 922KB
- Sample250402-jppsyswnv7
- SHA256 d4ae7e790e777630f32cacb8b2975a478a7058f1e19010bb5f2d7e389ed64b40
- MD5 1fa4a5c689de43891a6fc6749c8b8a03
- SHA1 7d7d546bd5d42e7d829cbbbdafeff4f966b957ea
- SHA512 9039466c7f8fca96755f2d3c677c5ca08ea35638a00d9cee7769ec0ea8c0882a5ab15696fb3b5b6e71f4ac7a8fc537e20b75c2a7ba80c06e1acdcd48d69e5573
- SSDEEP 24576:Qj2n6niR7shMTkEgYVGF7nhKiYtgn/Z6cvTXI5WANQtT:QjbniRAhQnVGF7h+en/I4TXeNQtT
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
OC & COA.exe
Resource
win10v2004-20250314-en
10 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.agaliofu.top
-
Port
587
-
Username
-
Password
QPS.6YYl.Yi=
-
Email to
Targets
-
- Target OC & COA.exe
- Size 922KB
- SHA256 d4ae7e790e777630f32cacb8b2975a478a7058f1e19010bb5f2d7e389ed64b40
- MD5 1fa4a5c689de43891a6fc6749c8b8a03
- SHA1 7d7d546bd5d42e7d829cbbbdafeff4f966b957ea
- SHA512 9039466c7f8fca96755f2d3c677c5ca08ea35638a00d9cee7769ec0ea8c0882a5ab15696fb3b5b6e71f4ac7a8fc537e20b75c2a7ba80c06e1acdcd48d69e5573
- SSDEEP 24576:Qj2n6niR7shMTkEgYVGF7nhKiYtgn/Z6cvTXI5WANQtT:QjbniRAhQnVGF7h+en/I4TXeNQtT
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext