General
-
Target
Pending Balance Updated.exe
-
Size
703KB
-
Sample
230327-sytb6sgb6v
-
MD5
ab92b205a179da227d2e5f7b83a6f251
-
SHA1
42527dc009ad1df479c1ac84e8d787258ef6804c
-
SHA256
b70a16122bd7d485a520eb177209f1c39bd74dbe0ef8502c56a8706f4c9450bc
-
SHA512
f8d7bb53b0b7d67bb688b95649d5f477b50d78d3c6b3a1c819def97029193cd70542c7ed69f9a2d9e335e7220a616758ea91bab9f923ead3cd7becab99fcf963
-
SSDEEP
12288:zzSeLEgNGSD7QK/xNei0XpfiLPDDwTusreui8Hc1:qegMM+xR0XePDDwh1Hc
Static task
static1
Behavioral task
behavioral1
Sample
Pending Balance Updated.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Pending Balance Updated.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.clipjoint.co.nz - Port:
587 - Username:
clipjoint@clipjoint.co.nz - Password:
melandloz64 - Email To:
geortiok4@gmail.com
Targets
-
-
Target
Pending Balance Updated.exe
-
Size
703KB
-
MD5
ab92b205a179da227d2e5f7b83a6f251
-
SHA1
42527dc009ad1df479c1ac84e8d787258ef6804c
-
SHA256
b70a16122bd7d485a520eb177209f1c39bd74dbe0ef8502c56a8706f4c9450bc
-
SHA512
f8d7bb53b0b7d67bb688b95649d5f477b50d78d3c6b3a1c819def97029193cd70542c7ed69f9a2d9e335e7220a616758ea91bab9f923ead3cd7becab99fcf963
-
SSDEEP
12288:zzSeLEgNGSD7QK/xNei0XpfiLPDDwTusreui8Hc1:qegMM+xR0XePDDwh1Hc
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-