General
-
Target
payment advise.exe
-
Size
927KB
-
Sample
210727-zcl9736lhe
-
MD5
be85265738633fe3cd59f95bab85bddb
-
SHA1
73b701dafe47b4da709a349dfe24ac87a08abfe7
-
SHA256
7729f33528cbe1b6f4c4f5e695798b1561a2c2c615a88cfbc495254dd93ab81a
-
SHA512
f0c748030685272fda45d161226c2680a402c0776e902129e384f4ab7e76348af8e003f876dc090066ade26324a2d150f2ee9989ae2b3df6f2cd636d7762ab94
Static task
static1
Behavioral task
behavioral1
Sample
payment advise.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
payment advise.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
paola.micheli@copangroup.xyz - Password:
gibson.1990
Targets
-
-
Target
payment advise.exe
-
Size
927KB
-
MD5
be85265738633fe3cd59f95bab85bddb
-
SHA1
73b701dafe47b4da709a349dfe24ac87a08abfe7
-
SHA256
7729f33528cbe1b6f4c4f5e695798b1561a2c2c615a88cfbc495254dd93ab81a
-
SHA512
f0c748030685272fda45d161226c2680a402c0776e902129e384f4ab7e76348af8e003f876dc090066ade26324a2d150f2ee9989ae2b3df6f2cd636d7762ab94
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-