General
-
Target
Debit Note.exe
-
Size
685KB
-
Sample
230212-kbabsabe42
-
MD5
1a431097afb48954b94defec865d84f5
-
SHA1
eaafb2d6af27cec988ac6829ff528066771fe736
-
SHA256
309dd7ed63e9360abcb589290adda980a24e8a327d0090c6c839e306bada6558
-
SHA512
32685dec6fea0e2c149cfa4ce2828f0a461468fffb4c19ab709fa9e1fc2a5baf3d0812fb55805895a464dba71a896a0011457ab7cc5e30167e27cb06b5be9334
-
SSDEEP
12288:PuAskehLWn7dfWXeea+wpfXGJAHqvayEgfkxguPZW7z0JIZmDzOOua61A:W9LqYef+MHCGg8xgqZW7z0JIZm36
Static task
static1
Behavioral task
behavioral1
Sample
Debit Note.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Debit Note.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/
Targets
-
-
Target
Debit Note.exe
-
Size
685KB
-
MD5
1a431097afb48954b94defec865d84f5
-
SHA1
eaafb2d6af27cec988ac6829ff528066771fe736
-
SHA256
309dd7ed63e9360abcb589290adda980a24e8a327d0090c6c839e306bada6558
-
SHA512
32685dec6fea0e2c149cfa4ce2828f0a461468fffb4c19ab709fa9e1fc2a5baf3d0812fb55805895a464dba71a896a0011457ab7cc5e30167e27cb06b5be9334
-
SSDEEP
12288:PuAskehLWn7dfWXeea+wpfXGJAHqvayEgfkxguPZW7z0JIZmDzOOua61A:W9LqYef+MHCGg8xgqZW7z0JIZm36
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-