General
-
Target
Outstanding invoice.zip
-
Size
555KB
-
Sample
231208-t6jndabbar
-
MD5
87f38d276b6f9ced88377836f1787fd8
-
SHA1
d5506458f49bb9e6378e79cf20a807a38c0c5dd1
-
SHA256
01ed56a5556f6d85f02a1aba0c9f567a6ddd9aab974c7eb7beb6ad35ac8d644a
-
SHA512
b4f8089b059725f4b335d6fd6466e2b82e3b86375050ab371ab0f2611511e69f5a070ff765917f30955576d7579e7620a3a3112ca414e5e77c7fafe10f1eaea8
-
SSDEEP
12288:T3fAT0faCQRzLyufxHdCwcQoqXNivZGhp3Jn7GYyjxVCC:jS0fQR5JZcxqXlhp3JnNyjR
Static task
static1
Behavioral task
behavioral1
Sample
Outstanding invoice.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
Outstanding invoice.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.elec-qatar.com - Port:
587 - Username:
[email protected] - Password:
MHabrar2019@# - Email To:
[email protected]
Targets
-
-
Target
Outstanding invoice.exe
-
Size
586KB
-
MD5
b8915103e9d639e762e83cf9c8bda9a9
-
SHA1
a9650b8e7d490e933bd05aa4539a617ed5319f03
-
SHA256
ce18daad377673d765ae77224400740842cc31aee43a2cdb5e5ac564fbbe908d
-
SHA512
f27fe7eb6d649fe81d8e6a64e775c8a32901161d1d4eab3bb4c525d9927e5716f015be7a72997f90b5cfbaa3daf0681fdd2d516fd7154ee42a24a4c8d1889919
-
SSDEEP
12288:XhkZ5IbmQRzs42dKmicNLXndCwcso0vji5RqhZjhnBCnZOvbzRof:XK/IKQRIsuzZcd0v1hZjhnYn8DzRof
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-