General
-
Target
Factura.exe
-
Size
524KB
-
Sample
211203-vtp53ahahn
-
MD5
9ce8e1a2f2f63a30c739ae2161a180ec
-
SHA1
937c3210cf4afc9f48a81b55c5d715f41bf6cfe6
-
SHA256
92fd046d9037a844e44c13dd287042186f7351f9a78779408bf71004e64dbbd3
-
SHA512
4b338f9441b43c8b592d2bf5ac3e25d2755d761b456ce6e9ac397416af7b1100f9e182758d1aebd9631bb981d2f2a807c27e30e51d2f0dd093bf335c9ff2bedb
Static task
static1
Behavioral task
behavioral1
Sample
Factura.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
Factura.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.waterchem.com.tr - Port:
587 - Username:
[email protected] - Password:
Q]b9[cc7kHK&
Targets
-
-
Target
Factura.exe
-
Size
524KB
-
MD5
9ce8e1a2f2f63a30c739ae2161a180ec
-
SHA1
937c3210cf4afc9f48a81b55c5d715f41bf6cfe6
-
SHA256
92fd046d9037a844e44c13dd287042186f7351f9a78779408bf71004e64dbbd3
-
SHA512
4b338f9441b43c8b592d2bf5ac3e25d2755d761b456ce6e9ac397416af7b1100f9e182758d1aebd9631bb981d2f2a807c27e30e51d2f0dd093bf335c9ff2bedb
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-