General
-
Target
1C9478897630140F119FDCB632C471C8237F49982A432F87D065F1027C3B44AA
-
Size
631KB
-
Sample
231206-epntfaba77
-
MD5
918e3d8125b242d0f60e01e1e562cd8e
-
SHA1
5ade413de36b1110957c4d43df99c25de11fdf09
-
SHA256
1c9478897630140f119fdcb632c471c8237f49982a432f87d065f1027c3b44aa
-
SHA512
d491505745224c79f74721a45b231b59e83dd17ff5b1cf6fee3d2df9fd7db0069439d006b53c51af5a02976ddea2470d780193394e2248ce8c8136e06ebe02e5
-
SSDEEP
12288:PS1FBguLleEiBh1DIVvXmP2saQ04f/vKYAVH55G/cUMs5KH3:OguL4EE/IVvXd34XwGEURgH3
Static task
static1
Behavioral task
behavioral1
Sample
E-Payment Copy.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
E-Payment Copy.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.svnprintechnologies.com - Port:
587 - Username:
[email protected] - Password:
Svnprint@1234 - Email To:
[email protected]
Targets
-
-
Target
E-Payment Copy.exe
-
Size
726KB
-
MD5
0a42b7c6892fea5fd8dd83081b370b41
-
SHA1
8af42b1368d5241f10912579ae8bfe8daf63b6b8
-
SHA256
e867aa353bc6f4269ab0a3d6174012ec741ab5b61b83117dedae25c5701d965c
-
SHA512
e357837d04d3a72159795b125000e5bc64613862626bcb256f736186e020c76d044901a988efe26301143a42b84ab97c95f8ac5ead9d09f4f17a593a0fb30692
-
SSDEEP
12288:3dIBt389ZiyQAUNpixgVqsdDXz3Vf4PlQzPvcCb4iG:3wiH8WobXGcPkCb4iG
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-