General
- Target INVOICE.exe
- Size 1.1MB
- Sample230212-pgln8adh23
- SHA256 96af204d2dfb74c2fba800c451c04b6c71443be7bd68fadcf718cfda4cfb20e5
- MD5 78dfa5994262c47d987d821d347b931b
- SHA1 84ddd88987dbad1896ae29b2e9f90846e31279dd
- SHA512 b99dfcc2a882b89f498d4f798ced0049ea21171e4721b7953066ab3f868d6c8ba66b134b4560265ca84834211755f1eeae721fdc2b9a541d9ac571ec5bfbf8bb
- SSDEEP 12288:NauTzBmGbmJo0fFPNRLBSboXonvgu9ku88jTiDwJw2b/hd65SWuctxbjkGkBfsff:SUge/iDCYwh6W
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE.exe
Resource
win7-20221111-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
INVOICE.exe
Resource
win10v2004-20221111-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.expertsconsultgh.co
-
Port
587
-
Username
-
Password
Oppong.2012
-
Email to
Targets
-
- Target INVOICE.exe
- Size 1.1MB
- SHA256 96af204d2dfb74c2fba800c451c04b6c71443be7bd68fadcf718cfda4cfb20e5
- MD5 78dfa5994262c47d987d821d347b931b
- SHA1 84ddd88987dbad1896ae29b2e9f90846e31279dd
- SHA512 b99dfcc2a882b89f498d4f798ced0049ea21171e4721b7953066ab3f868d6c8ba66b134b4560265ca84834211755f1eeae721fdc2b9a541d9ac571ec5bfbf8bb
- SSDEEP 12288:NauTzBmGbmJo0fFPNRLBSboXonvgu9ku88jTiDwJw2b/hd65SWuctxbjkGkBfsff:SUge/iDCYwh6W
- MD5 SHA1 SHA512 SSDEEP
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
Uses the VBS compiler for execution
Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext