General
-
Target
Remittance slip.exe
-
Size
372KB
-
Sample
230706-qy359sbg55
-
MD5
758f5c1f99738cc2a59a385ce63e9a21
-
SHA1
22c825fcdc8c78a5f4339ae98754a423ba67a2a1
-
SHA256
b017455b50865cfdd26486b8c6d8348294ee6fba27ea97eb2d94e6a56b7397b5
-
SHA512
aca0e6800300b410a27dac7740981d5fa1711ca86c752855e0f23ad786931a2e92a507d3c57b880d8fbdbf947f7de58c80b1bb6d3dacb555abc28ca49ee2e491
-
SSDEEP
6144:/Ya65Gb4fu5qu5/9vkkq4Bd1QO8E2qtDAQMynxwAC+wNkm3iiI9kcZXUgApaYIno:/YDGbgu5qu5/9UWUO8EfkQBxK+weiWRw
Static task
static1
Behavioral task
behavioral1
Sample
Remittance slip.exe
Resource
win7-20230705-en
Behavioral task
behavioral2
Sample
Remittance slip.exe
Resource
win10v2004-20230703-en
Malware Config
Targets
-
-
Target
Remittance slip.exe
-
Size
372KB
-
MD5
758f5c1f99738cc2a59a385ce63e9a21
-
SHA1
22c825fcdc8c78a5f4339ae98754a423ba67a2a1
-
SHA256
b017455b50865cfdd26486b8c6d8348294ee6fba27ea97eb2d94e6a56b7397b5
-
SHA512
aca0e6800300b410a27dac7740981d5fa1711ca86c752855e0f23ad786931a2e92a507d3c57b880d8fbdbf947f7de58c80b1bb6d3dacb555abc28ca49ee2e491
-
SSDEEP
6144:/Ya65Gb4fu5qu5/9vkkq4Bd1QO8E2qtDAQMynxwAC+wNkm3iiI9kcZXUgApaYIno:/YDGbgu5qu5/9UWUO8EfkQBxK+weiWRw
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-