General
-
Target
2acddc678ea970cfb45042c954b8a268.zip
-
Size
672KB
-
Sample
230605-mrt28sge5x
-
MD5
389fe6f2e64cc0306a72301e21204de9
-
SHA1
9d4ea43ff5ac6e1cc193c810230b2e496c396552
-
SHA256
b528fb4eed7042c51b8ceea829129e945abcffd7b6c11eb00171e13cbf3b0e8d
-
SHA512
863879524f8c222b69f2b7aa9a6ea0633ea081d1218a1d07471f3dee8a4e9e722d0456fed2d651f9556c4e81edf0351c72da8bbd925f9c5f4de4235def8a7c24
-
SSDEEP
12288:8pZaL0s0g7/6/s7MHqdp0dwValW9FHgUVt+Ul/qMgm7MMPMwZkRr1:8pZaos0Ay/S9UdwVRzHgUVt+D+MsFoJ
Static task
static1
Behavioral task
behavioral1
Sample
K.V.L. EUR 5,418.41 20230131144411-PDF.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
K.V.L. EUR 5,418.41 20230131144411-PDF.exe
Resource
win7-20230220-en
Behavioral task
behavioral3
Sample
K.V.L. EUR 5,418.41 20230131144411-PDF.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.rediffrnail.com - Port:
587 - Username:
[email protected] - Password:
VhQ)^ti5 - Email To:
[email protected]
Targets
-
-
Target
K.V.L. EUR 5,418.41 20230131144411-PDF.exe
-
Size
815KB
-
MD5
2acddc678ea970cfb45042c954b8a268
-
SHA1
e27c3436cb48d0b49adc30b19a5471d6960de709
-
SHA256
1fed6157fe887393791035cca1424ff56a3416202a55c58a6b44f902b6d5d873
-
SHA512
670e65b75b155dc63948d6d730f90e814c1c385ba26e04853dfa01070f52da3fa6ec6b4aa296adaf5c4de271ca3fbf2bb50e85456685270a9ecf0325b92f244e
-
SSDEEP
24576:+MqsFHlWxMiQW/O4ue7AjtsVNL2HzCBjHKP+M:yulYMiQWmS7WtMcHzCwP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-