General
-
Target
overdue invoice pdf.rar
-
Size
611KB
-
Sample
230829-q1tplscg72
-
MD5
5b19802e5cbe5aeb4202dd0ac6e81c67
-
SHA1
af3242752e4ca0f0dc16b8b07b8b5374342b2e0d
-
SHA256
8d9ad4f756e359523361a8481180deb946ab887f6fd5d42c36038b6c81974b9f
-
SHA512
2dfa2d86192d73732ddc4ee867bf63a08cf47ddfefd18440259389748aee0b8295cff506ba1d073ecc48912c6d51a5c6b24ca04f0240474bc37156defe576b6c
-
SSDEEP
12288:oHUxA/WKMt+a/B+phHjw+DsJIxBgQEliXSePl0M36:oHh/WKk/BqhDf5BgQE40N
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
host2069.hostmonster.com - Port:
587 - Username:
[email protected] - Password:
me!@#!@#!@#!@# - Email To:
[email protected]
Targets
-
-
Target
overdue invoice pdf.exe
-
Size
646KB
-
MD5
79cc78ff75cac04dddfa6da6ff4320a3
-
SHA1
b755efb1b00e46574d024b33d016718b79861656
-
SHA256
d8ba3d84e3d6655458d8c886913e71fbb9e0b72457e6a091f9055ef78e804820
-
SHA512
31d18b336710276d390d47ac8d0ff32ea4201fc726e2c2dca001451be5df660222227ee46855619cbb6e498b33f76c242417e393f5e514d9cd94fd87799f2d9b
-
SSDEEP
12288:kaC0h6EY1raE60bGv6onXttJT2EyaeGMKqoASuZvOMmBVll/:kFS7Zo1ugzJJoAS+/K
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-