General
-
Target
INVOICE.exe
-
Size
572KB
-
Sample
211202-hgxm6acchn
-
MD5
2c42e7848e2520f517c0eb3cff9a17fb
-
SHA1
fe03a9798d36770f1500b6f35b9a33eb6d391189
-
SHA256
b11f12b8f638596e52dc43332ae8ead3d29d47dcb90ba2fb13e7e08811b895c8
-
SHA512
99216c285a66d4c841936b484879f311b01df989744f81026bb2a93b350bcf373f3fff3257ed9f01a680cb6cf469d2d050d6caf4275eed726907c344c94988c5
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
INVOICE.exe
Resource
win10-en-20211104
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.focuzpartsmart.com - Port:
587 - Username:
[email protected] - Password:
Fpmabi@2016
Targets
-
-
Target
INVOICE.exe
-
Size
572KB
-
MD5
2c42e7848e2520f517c0eb3cff9a17fb
-
SHA1
fe03a9798d36770f1500b6f35b9a33eb6d391189
-
SHA256
b11f12b8f638596e52dc43332ae8ead3d29d47dcb90ba2fb13e7e08811b895c8
-
SHA512
99216c285a66d4c841936b484879f311b01df989744f81026bb2a93b350bcf373f3fff3257ed9f01a680cb6cf469d2d050d6caf4275eed726907c344c94988c5
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-