General
- Target pago de la factura 11-369013.PDF.exe
- Size 498KB
- Sample230310-meszeacg35
- SHA256 3b185f9e2349e436272277d50a22df609a8253d0fafb2c53ea003083b2196689
- MD5 649dc8832473cbc0ee81cb42865c54b9
- SHA1 89c063f4177c9845f565e82c8e2ed37984d51fa0
- SHA512 bf2e66c2549e8115844ebfe837607c5b388166750b4c0761584dde89c32ad2412100c4ef4b7a61baef1913c980acd6cebdc4d49be0271f1ac0b234c059fd4416
- SSDEEP 12288:k0UMzHyYogIffWGGjEZJyvWjF6jkS5F3ph:RZSYWwEZJyvWp6533
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
pago de la factura 11-369013.PDF.exe
Resource
win7-20230220-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
pago de la factura 11-369013.PDF.exe
Resource
win10v2004-20230220-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
ftp
-
Host
ftp://ftp.sisoempresarialsas.com
-
Port
21
-
Username
-
Password
.!LV?]FKWxUy
Targets
-
- Target pago de la factura 11-369013.PDF.exe
- Size 498KB
- SHA256 3b185f9e2349e436272277d50a22df609a8253d0fafb2c53ea003083b2196689
- MD5 649dc8832473cbc0ee81cb42865c54b9
- SHA1 89c063f4177c9845f565e82c8e2ed37984d51fa0
- SHA512 bf2e66c2549e8115844ebfe837607c5b388166750b4c0761584dde89c32ad2412100c4ef4b7a61baef1913c980acd6cebdc4d49be0271f1ac0b234c059fd4416
- SSDEEP 12288:k0UMzHyYogIffWGGjEZJyvWjF6jkS5F3ph:RZSYWwEZJyvWp6533
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext