General
-
Target
Factura 09906899809.exe
-
Size
636KB
-
Sample
231203-spqjxscd64
-
MD5
648d24805b6396c7829ed03801c3afcd
-
SHA1
3124010bdb515f06aba5de75331e2681e9941f83
-
SHA256
20227c6e65e5acfb344a1a022cffb491f753a7194c1f9e639c2c6f33658abfb4
-
SHA512
be6b834d1b2fc2292a5b119fbbad517b244a651e088ebdf475ebdec76b9646dbf62ea0f0a448906908f779128bbc004e9430287ce6f1d72ae7b5d5f2db45819c
-
SSDEEP
12288:4Ppjzd7BR6wT/wZ/H/0jkD1KNTb6Ff0pjlfYeFMpukznHGtuWSX0:4PpjzpBcZ/H8jxNTGlkjlf9FMxHWSE
Static task
static1
Behavioral task
behavioral1
Sample
Factura 09906899809.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
Factura 09906899809.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.ardsmmm.com - Port:
587 - Username:
[email protected] - Password:
Ard2015** - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.ardsmmm.com - Port:
587 - Username:
[email protected] - Password:
Ard2015**
Targets
-
-
Target
Factura 09906899809.exe
-
Size
636KB
-
MD5
648d24805b6396c7829ed03801c3afcd
-
SHA1
3124010bdb515f06aba5de75331e2681e9941f83
-
SHA256
20227c6e65e5acfb344a1a022cffb491f753a7194c1f9e639c2c6f33658abfb4
-
SHA512
be6b834d1b2fc2292a5b119fbbad517b244a651e088ebdf475ebdec76b9646dbf62ea0f0a448906908f779128bbc004e9430287ce6f1d72ae7b5d5f2db45819c
-
SSDEEP
12288:4Ppjzd7BR6wT/wZ/H/0jkD1KNTb6Ff0pjlfYeFMpukznHGtuWSX0:4PpjzpBcZ/H8jxNTGlkjlf9FMxHWSE
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-