General
-
Target
PROFORMA INVOICE.zip
-
Size
384KB
-
Sample
211203-vqhxkscae5
-
MD5
02252c29c14fc1f746b6cafc0c5c6be7
-
SHA1
ed39a3d5801955e296a7bf04a1efd75db8ae9ce2
-
SHA256
9f29d32cd39ebcf55f179a21ce07d4cb793d211020b323eb02a122a628ee483e
-
SHA512
ca4f62ce2ad65da0c4a9427283399f1b57047d0a45a582c98194b70941a2d9b311de697b2404cc1029633eacbe45ba303b2455c802854ebacc4de55f983684b4
Static task
static1
Behavioral task
behavioral1
Sample
PROFORMA INVOICE.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
PROFORMA INVOICE.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.dieseltronic.com.pe - Port:
587 - Username:
[email protected] - Password:
Asdiesel2019@?%%%,
Targets
-
-
Target
PROFORMA INVOICE.exe
-
Size
463KB
-
MD5
563ace61f357fe73207c546cbec9c0cd
-
SHA1
6cc9bbe6704f4a54105502672d246e97d3c9688e
-
SHA256
9beb57914c705bfd2a1bfaca1bd2f4beca2a2cd8dff49229558bca04774a360a
-
SHA512
a48b165149fdd63b2ea95bafec0b4a22ca615530dabcb206a584d38d8cc3d7f4d1da3b64dc6096eaa4507d9bc98f115930384258873513b64b856b94d6934cda
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-