General
- Target 29072026_0242_21072026_Sevkiyat Belgeleri.............rar
- Size 1.8MB
- Sample260729-c7acnasglb
- SHA256 da2f79c19df50bd09578357e1e51e97d7b87b9c9c3a387d1d137b3367875baab
- MD5 6b41db3ccf9271654b2a57ae1283dbf2
- SHA1 43148d9c44d1840f48f9df6800c8eb6513a6da3e
- SHA512 3cd3da67e0002a9b15a0a7efd4ec9d441586f9c0cc0e6e22412ee4b9448a21b32ae1ab95ae69222aade2c99529ec89b579735c764cd28b0f0cf80dd0c9783eb5
- SSDEEP 49152:uqHpc+vXrsh2zUOwt4KnUWUveqHpc+vXrsh2zUOwt4KnUWUvG:VJceXggaJnUxNJceXggaJnUxe
- TLSH T10C953354D845FAAABC9A8E1C4D2B2226026C1B023FE518042FE5B749FD61FFDE8754D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Sevkiyat Belgeleri.............exe
Resource
win10v2004-20260513-en
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
Sevkiyat Belgeleri.............exe
Resource
win11ltsc2024-20260709-en
8 signatures
300 seconds
Behavioral task
behavioral3
Sample
Sevkiyat Belgeleri............exe
Resource
win10v2004-20260513-en
8 signatures
300 seconds
Behavioral task
behavioral4
Sample
Sevkiyat Belgeleri............exe
Resource
win11ltsc2024-20260709-en
8 signatures
300 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
ftp
-
Host
ftp://backup.smartape.ru
-
Port
21
-
Username
user894492
-
Password
w6NZOdcSkH1a
Targets
-
- Target Sevkiyat Belgeleri.............exe
- Size 1.0MB
- SHA256 9b67248e617a81db282cac23decbe4de0bcc84de74f2db22f10b66074fb925f4
- MD5 2bbe1d096bc568669445542e632937f7
- SHA1 a202d36a7b699b900775d6cdeb634abc1a1077a5
- SHA512 1ea70923a93838d1e5a1a170f43891b9c256b83d6df3a7195439a39a0f404c2ff19e3427eb0a44c6f0c479ebef37ce77835d3c8b3b151e1bf85afdc4f7026bb5
- SSDEEP 24576:Cp50y/gA8Dh4OwWc1GuBOEfng7uzXPIikDukZcZJ+qILxZdfAh65koV:Cpt/CKMuOq8gXghqILTdEAdV
- TLSH T13235F150236B8C42E0E68BB6E9F0D37432651EDEB8E3C2875FE51FA778153C29994352
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-
- Target Sevkiyat Belgeleri............exe
- Size 1.0MB
- SHA256 9b67248e617a81db282cac23decbe4de0bcc84de74f2db22f10b66074fb925f4
- MD5 2bbe1d096bc568669445542e632937f7
- SHA1 a202d36a7b699b900775d6cdeb634abc1a1077a5
- SHA512 1ea70923a93838d1e5a1a170f43891b9c256b83d6df3a7195439a39a0f404c2ff19e3427eb0a44c6f0c479ebef37ce77835d3c8b3b151e1bf85afdc4f7026bb5
- SSDEEP 24576:Cp50y/gA8Dh4OwWc1GuBOEfng7uzXPIikDukZcZJ+qILxZdfAh65koV:Cpt/CKMuOq8gXghqILTdEAdV
- TLSH T13235F150236B8C42E0E68BB6E9F0D37432651EDEB8E3C2875FE51FA778153C29994352
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Tasks
static1
Score
3/10
behavioral1
collectiondiscoveryagentteslakeyloggerspywarestealertrojan
Score
10/10
behavioral2
collectiondiscoveryagentteslakeyloggerspywarestealertrojan
Score
10/10
behavioral3
collectiondiscoveryagentteslakeyloggerspywarestealertrojan
Score
10/10
behavioral4
collectiondiscoveryagentteslakeyloggerspywarestealertrojan
Score
10/10