General
-
Target
PAYMENT ADVISE_0004.exe
-
Size
841KB
-
Sample
221206-ddwjgahc42
-
MD5
c57e9585bbe179e45833e8b896c73e29
-
SHA1
1c0aa52a527f919f0e575e00dcb7023c553f9d5c
-
SHA256
0a87339cba74896d097ec10a18315d66dc3f98121ba968ff571a29e241646b60
-
SHA512
15b2b749010b6da998063d24aa75a38b0fdda79c523f99b2ff1cc074f64d6551b5854a09adf44df434e4ede55e7562535650e54445bb94096620e10360575263
-
SSDEEP
12288:F/hXvkIY0GZa/4y1v8Vdv+UF9Co2dLi78dkLgxlkg586aWHffauQOQWM6x5BbWIb:8B03giZUFZ2dLg/gxlB5O8f4b
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT ADVISE_0004.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
PAYMENT ADVISE_0004.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1046885137620668476/tqKDZZWFXo6nvWfx10p4wfxf1QI6_dSmYl-LLQGbb4vhhmp9HT4sLvTVg0kj1SgRTQGZ
Targets
-
-
Target
PAYMENT ADVISE_0004.exe
-
Size
841KB
-
MD5
c57e9585bbe179e45833e8b896c73e29
-
SHA1
1c0aa52a527f919f0e575e00dcb7023c553f9d5c
-
SHA256
0a87339cba74896d097ec10a18315d66dc3f98121ba968ff571a29e241646b60
-
SHA512
15b2b749010b6da998063d24aa75a38b0fdda79c523f99b2ff1cc074f64d6551b5854a09adf44df434e4ede55e7562535650e54445bb94096620e10360575263
-
SSDEEP
12288:F/hXvkIY0GZa/4y1v8Vdv+UF9Co2dLi78dkLgxlkg586aWHffauQOQWM6x5BbWIb:8B03giZUFZ2dLg/gxlB5O8f4b
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-