General
-
Target
Invoice 3892764.exe
-
Size
790KB
-
Sample
231201-jdn3aafh63
-
MD5
e87a53f8119728e8c0e5432276f1fbd9
-
SHA1
617316663be1c8fe0a31d7e989ce7eae0a93e922
-
SHA256
279479d7f8311dc31a6123bb46451795ae79864582bccee23e3262119a218f34
-
SHA512
e02ea27617448d7193ed9f43cc0f93a68e1861bcb2697e0c0d069f9c3a83c93002ddeb9ccdb770a83f97cb590e6aa4f850951bde773a89caa68874418943b873
-
SSDEEP
12288:asxTA6qNb5y7QsDzVlEcSqXbUsiaB3xeX2lfpuMtUzKVXPTt0uSax:lxs6koFzAcSS+aneX2lwMlVXPZMs
Static task
static1
Behavioral task
behavioral1
Sample
Invoice 3892764.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Invoice 3892764.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.rmmarine.com.sg - Port:
587 - Username:
[email protected] - Password:
Rmms201809 - Email To:
[email protected]
Targets
-
-
Target
Invoice 3892764.exe
-
Size
790KB
-
MD5
e87a53f8119728e8c0e5432276f1fbd9
-
SHA1
617316663be1c8fe0a31d7e989ce7eae0a93e922
-
SHA256
279479d7f8311dc31a6123bb46451795ae79864582bccee23e3262119a218f34
-
SHA512
e02ea27617448d7193ed9f43cc0f93a68e1861bcb2697e0c0d069f9c3a83c93002ddeb9ccdb770a83f97cb590e6aa4f850951bde773a89caa68874418943b873
-
SSDEEP
12288:asxTA6qNb5y7QsDzVlEcSqXbUsiaB3xeX2lfpuMtUzKVXPTt0uSax:lxs6koFzAcSS+aneX2lwMlVXPZMs
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-