General
-
Target
08b76a88f66d8516c86235c95ed23d2f.bin
-
Size
595KB
-
Sample
240701-bgvegavcln
-
MD5
34d30f1fb4513d815319f423796c8f1f
-
SHA1
a42cdda18ab2589dfdbbb0229101f4f83b5edd81
-
SHA256
ea87c4711c77e3589c49669605b9f13e1a3377d0cc0c592f37c31c48bfb9fa03
-
SHA512
04d0532dea28524c625568e4b13ae85175a3126017c9414c616a449ce89034bc7fe2e3c81bd3f1a76558e5d91b4e2c3f97d2f6db53bd6103cc0da5df8e71a5ef
-
SSDEEP
12288:riI6D0xrBJuZ/ReDZIkU+HzW9LRxMkfgIh+QlTUWHhweNBg9T6EoDIZRPdOAS:d6otJMeDZi+HzYxMkfJT9hdNoT60ZRVe
Static task
static1
Behavioral task
behavioral1
Sample
e9d082e59f131a020a870a416b1fbd2aa978f0706fa690080a268a5295bd8bb2.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
e9d082e59f131a020a870a416b1fbd2aa978f0706fa690080a268a5295bd8bb2.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://backup.smartape.ru - Port:
21 - Username:
user889214 - Password:
RjYKRIRkfluo
Extracted
Protocol: ftp- Host:
backup.smartape.ru - Port:
21 - Username:
user889214 - Password:
RjYKRIRkfluo
Targets
-
-
Target
e9d082e59f131a020a870a416b1fbd2aa978f0706fa690080a268a5295bd8bb2.exe
-
Size
648KB
-
MD5
08b76a88f66d8516c86235c95ed23d2f
-
SHA1
fcd40fa82d38e3befe440ce6288ba45747934c17
-
SHA256
e9d082e59f131a020a870a416b1fbd2aa978f0706fa690080a268a5295bd8bb2
-
SHA512
a97d90096ebe8554f80507f2bffa8d779cfa6fa3044695c15cbba02fc423ec91d424cacf7a29e556ea3baaf5dc0d4544414c322909d7c34f1d1c24b136df0538
-
SSDEEP
12288:k99glhtjbCawLXB2dd3yqbgvBcZInLdpSqB/gwIFAthzljSPLDKPGdTGZbkdxc3w:kCwLRadCWZInLd/SAtGmGdYkdxccM4
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-