General
-
Target
Payment Advice - Advice Ref[A1T9IvYc5tfi].zip
-
Size
672KB
-
Sample
231205-h5r3kshg5w
-
MD5
d8e61bbe97b4d4cb7253119f3567091c
-
SHA1
792a8994425369249735f6dbc70377eddf592fbb
-
SHA256
56860daf17c4b320906062c4cb584870f93ae17b3659978cf9a812c66b1652c7
-
SHA512
e50c25e4278b5a974fbf72c0a59c9f87ae7435e826dc0166cdb0ea53a798abed299c3b404be2877b87ee1cc53cf129da857c583497b89a568b82b0ecf68ccd3a
-
SSDEEP
12288:f9scD1OxUzL5Nb6JmFgl8uEdG/d1SE2ZQtnmU+CnOye5l0yruC:fd1xb6Mgl8XG/LSE4QZmU+C1wl0dC
Static task
static1
Behavioral task
behavioral1
Sample
Payment Advice - Advice Ref[A1T9IvYc5tfi].exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
Payment Advice - Advice Ref[A1T9IvYc5tfi].exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.abi0expertise.com - Port:
587 - Username:
[email protected] - Password:
Najwa1949! - Email To:
[email protected]
Targets
-
-
Target
Payment Advice - Advice Ref[A1T9IvYc5tfi].exe
-
Size
696KB
-
MD5
4e981ade4af75b762286a9c134dc3c02
-
SHA1
13ca08fd8f8be794663a7f396f13a5352d3bb90a
-
SHA256
db7b9213e70bb9bed60555f01c763d0be56e6cff67c8b9c8f6b4929a88f6e15c
-
SHA512
a88da38cc544de1392da7332ee9f97dcec88e44f8d7f2f0ebd6c12326e8fe8d01ca7937646f8cdca049cbda8d98b6fe38defbd489592258a3f292f97f380be67
-
SSDEEP
12288:ASl5nF8ZVdqrlb69kLgl8QwdGZdLi82KgnunRFhtCG3ySrGI/:hlcqhb6qgl8bGZdi8GnYRFnHiSrG8
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-