General
-
Target
Payment Advice.exe
-
Size
612KB
-
Sample
230328-rk413sbe23
-
MD5
6d2037f5f6c268267806f3ad4fc8d474
-
SHA1
4b5aacf752bdde05ef409acdfcb8a263a5f33332
-
SHA256
43ca29562907e9985a5aac8f9e65627333d70f7b595066ce1affd69b52d3102d
-
SHA512
e6cbf3ac0db6ca8965fa421e0dc81e2998ed29556fc0485ee0b885a0c139df9c5f818882c6d67da03bd8f37bb6bce1b4554200aa7930f895e07f0cd1e43d6525
-
SSDEEP
12288:341c/uv4N1nkoKb2wHDNdRCRDPagDb3/YBQW7XeUHbKUx:sEN1koKqwHDNbSprlWbeObKUx
Static task
static1
Behavioral task
behavioral1
Sample
Payment Advice.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Payment Advice.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.strictfacilityservices.com - Port:
587 - Username:
accounts@strictfacilityservices.com - Password:
SFS!@#321 - Email To:
zamanic62@gmail.com
Targets
-
-
Target
Payment Advice.exe
-
Size
612KB
-
MD5
6d2037f5f6c268267806f3ad4fc8d474
-
SHA1
4b5aacf752bdde05ef409acdfcb8a263a5f33332
-
SHA256
43ca29562907e9985a5aac8f9e65627333d70f7b595066ce1affd69b52d3102d
-
SHA512
e6cbf3ac0db6ca8965fa421e0dc81e2998ed29556fc0485ee0b885a0c139df9c5f818882c6d67da03bd8f37bb6bce1b4554200aa7930f895e07f0cd1e43d6525
-
SSDEEP
12288:341c/uv4N1nkoKb2wHDNdRCRDPagDb3/YBQW7XeUHbKUx:sEN1koKqwHDNbSprlWbeObKUx
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-