General
-
Target
Facturas Pagadas al Vencimiento 2.bat
-
Size
508KB
-
Sample
200707-za5f6dd862
-
MD5
93873ad64ae56bcd5eb73cf3f5495c39
-
SHA1
af6f2ea498166aae38a363c87e9af905b19ccb59
-
SHA256
a6e37f96da16a4f2be724e41fb5aa0ddcb75ba281b2dcf2077779592ab0ed5bb
-
SHA512
21253a63dc8788a841effcecb445930e811974e26e01b4bb490905cc5e8066dd2f41307b6674a94788971337d615b3e05feebbfab0b5528b117e171425416d96
Static task
static1
Behavioral task
behavioral1
Sample
Facturas Pagadas al Vencimiento 2.bat.exe
Resource
win7
Behavioral task
behavioral2
Sample
Facturas Pagadas al Vencimiento 2.bat.exe
Resource
win10
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.imacdeveracruz.com - Port:
587 - Username:
[email protected] - Password:
Nal02ti*
Targets
-
-
Target
Facturas Pagadas al Vencimiento 2.bat
-
Size
508KB
-
MD5
93873ad64ae56bcd5eb73cf3f5495c39
-
SHA1
af6f2ea498166aae38a363c87e9af905b19ccb59
-
SHA256
a6e37f96da16a4f2be724e41fb5aa0ddcb75ba281b2dcf2077779592ab0ed5bb
-
SHA512
21253a63dc8788a841effcecb445930e811974e26e01b4bb490905cc5e8066dd2f41307b6674a94788971337d615b3e05feebbfab0b5528b117e171425416d96
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-