General
-
Target
Balance invoice.zip
-
Size
623KB
-
Sample
231207-mqjj4she59
-
MD5
2dbb834ed8daa9aec1a8e41d9024c903
-
SHA1
79f62013316c38b717d94ec548a3b3e15a38e2d1
-
SHA256
efb87c3e13a30fef236edeec3ddb0f15bae42c2d38026a9a9552b3ed3d686f31
-
SHA512
9aa1c0e98942c1444cec1f60e85d9aec23601724364b28279f27bc68feb775135d445bea18305fed16caa38a23347df4d6d34425061a6bd66d8269c20d5eb3e3
-
SSDEEP
12288:yuFbbDS+zn45im1C13BxL3TSiuUE2KaEu+SeOxJVxel9CSFG2Zz9+waC:yUCIn4t013P3TSiuMKaF7dxelYSFVxP
Static task
static1
Behavioral task
behavioral1
Sample
Balance invoice.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Balance invoice.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.elec-qatar.com - Port:
587 - Username:
[email protected] - Password:
MHabrar2019@# - Email To:
[email protected]
Targets
-
-
Target
Balance invoice.exe
-
Size
665KB
-
MD5
96f35afff27509e6f78a8add621120a7
-
SHA1
1b095ff5a3ca286029c72dca0bdca94eeffac305
-
SHA256
ba5b23fdbec77442d3d5e9e87ea46dba8ce7df395fa5668edabe9be96eebae10
-
SHA512
c27e90ce2e782f7a8dc3923e324aa654d9cd68554214438b9680003f98d1b0f9288cb7b2c601ccc084a82aa1db0e30ab89e485361c84e1b5521d13c9911fb6b2
-
SSDEEP
12288:Aqc3+GCueH5qNvmL3z8pucAmKE4uqSAs1xVHel9C+0RU2IWUkRmLhR:A/uG2qc36uuKEBPNHelY+0pzNmz
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-