General
-
Target
Payment Slip.exe
-
Size
81KB
-
Sample
211018-p2dt4sdeh5
-
MD5
6e93f7298beda239f60083a0c5425060
-
SHA1
3eae538f716c7ef96ec27915d966e5ee8eb95f61
-
SHA256
f3a8222b6462aafcc1d47fa1a1ca8972daf438b0d98666308958982307ab88fd
-
SHA512
559cf0a364fb1e2fd6d40a0113d201e81f531c325aaf4ddb701b1343bfedb654ed7ab34a0eff07eeb5cde7e5cf674bf5cd0fabc55b3638b26e77cd8cf31c4a23
Static task
static1
Behavioral task
behavioral1
Sample
Payment Slip.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Payment Slip.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.croatiahunt.com - Port:
587 - Username:
[email protected] - Password:
VilaVrgade852
Targets
-
-
Target
Payment Slip.exe
-
Size
81KB
-
MD5
6e93f7298beda239f60083a0c5425060
-
SHA1
3eae538f716c7ef96ec27915d966e5ee8eb95f61
-
SHA256
f3a8222b6462aafcc1d47fa1a1ca8972daf438b0d98666308958982307ab88fd
-
SHA512
559cf0a364fb1e2fd6d40a0113d201e81f531c325aaf4ddb701b1343bfedb654ed7ab34a0eff07eeb5cde7e5cf674bf5cd0fabc55b3638b26e77cd8cf31c4a23
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Downloads MZ/PE file
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-