General
-
Target
FACTURAS PENDIENTES DE PAGO.exe
-
Size
877KB
-
Sample
220921-nz5z5sgbg8
-
MD5
3772656d859f951b41ed9897c3c61a6a
-
SHA1
bff4ee2bc5dc1e0856b143fad4731b9d11cf09bf
-
SHA256
c6a9aa7e0a62bdbd7ed39273a2e117e8b6efa5c1c535a0a521fa75cb82d0ca95
-
SHA512
7d24d52a14a403a798e315ed7ae05e537eac588604b2085c1e388f796aba76642b8c594ea47c9b03e66a5a1329b8d7ac20765df6ea7d88d8ab9c69f1716d257d
-
SSDEEP
24576:5CEKj8b1js/u+NeqnpwIsVzChFb4Kox5CZFUQtSxgOXdvpN:5CEs4j6yqnpwIsVzChFb4Kox5CZFUQt
Static task
static1
Behavioral task
behavioral1
Sample
FACTURAS PENDIENTES DE PAGO.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
FACTURAS PENDIENTES DE PAGO.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.entreosrios.com - Port:
587 - Username:
[email protected] - Password:
Ticote42?
Extracted
agenttesla
Protocol: ftp- Host:
%2B - Port:
21 - Username:
application/x-www-form-urlencoded - Password:
image/jpg
p=
Targets
-
-
Target
FACTURAS PENDIENTES DE PAGO.exe
-
Size
877KB
-
MD5
3772656d859f951b41ed9897c3c61a6a
-
SHA1
bff4ee2bc5dc1e0856b143fad4731b9d11cf09bf
-
SHA256
c6a9aa7e0a62bdbd7ed39273a2e117e8b6efa5c1c535a0a521fa75cb82d0ca95
-
SHA512
7d24d52a14a403a798e315ed7ae05e537eac588604b2085c1e388f796aba76642b8c594ea47c9b03e66a5a1329b8d7ac20765df6ea7d88d8ab9c69f1716d257d
-
SSDEEP
24576:5CEKj8b1js/u+NeqnpwIsVzChFb4Kox5CZFUQtSxgOXdvpN:5CEs4j6yqnpwIsVzChFb4Kox5CZFUQt
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-