General
-
Target
INVOICE.zip
-
Size
384KB
-
Sample
211203-t68x9shaeq
-
MD5
447ddfd1ddb33c8cb23f16a53527fe2c
-
SHA1
5759b1d735ed02998727afdb6a439874e06159fe
-
SHA256
68f2584ddb6baf667886e3bf191128ed59209ddf7265926e6cf91da530a0146b
-
SHA512
f0767d0f40f2f70a869d3f2327178002fa879190c592111f35bac012a350046e166f3016fef46d144989c3006b3d8e972bb3633b60f126dde3e2868caba00689
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
INVOICE.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.dieseltronic.com.pe - Port:
587 - Username:
asistente@dieseltronic.com.pe - Password:
Asdiesel2019@?%%%,
Targets
-
-
Target
INVOICE.exe
-
Size
463KB
-
MD5
563ace61f357fe73207c546cbec9c0cd
-
SHA1
6cc9bbe6704f4a54105502672d246e97d3c9688e
-
SHA256
9beb57914c705bfd2a1bfaca1bd2f4beca2a2cd8dff49229558bca04774a360a
-
SHA512
a48b165149fdd63b2ea95bafec0b4a22ca615530dabcb206a584d38d8cc3d7f4d1da3b64dc6096eaa4507d9bc98f115930384258873513b64b856b94d6934cda
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-