General
-
Target
INVOICE.zip
-
Size
468KB
-
Sample
211202-qsdnescag5
-
MD5
15399ee8f9c1c99806ea7e155b1dd720
-
SHA1
95539731553438d85d730ca308fec8641a4faa18
-
SHA256
e309a432d780486b1bad1716e2aee617acad9aac62cdbebb9615689373978ff4
-
SHA512
a3325e38eec54caca2b31d7bc8e80332b71593f4860e40e2436cf8def003e0b2d413470e3a82b07197b4884b5fb23b4754b536454b90ae9189b066fc294d478b
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
INVOICE.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.focuzpartsmart.com - Port:
587 - Username:
abigeorge@focuzpartsmart.com - Password:
Fpmabi@2016
Targets
-
-
Target
INVOICE.exe
-
Size
572KB
-
MD5
2c42e7848e2520f517c0eb3cff9a17fb
-
SHA1
fe03a9798d36770f1500b6f35b9a33eb6d391189
-
SHA256
b11f12b8f638596e52dc43332ae8ead3d29d47dcb90ba2fb13e7e08811b895c8
-
SHA512
99216c285a66d4c841936b484879f311b01df989744f81026bb2a93b350bcf373f3fff3257ed9f01a680cb6cf469d2d050d6caf4275eed726907c344c94988c5
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-