General
-
Target
Order - 07876575.exe
-
Size
696KB
-
Sample
231212-nxv26adhd2
-
MD5
3c7a5fd2797f25dde0e89456cc02bc36
-
SHA1
6e5e7b59c6433edaa3de647101d3832c1e8195c8
-
SHA256
9cca6b74cfa89d8505f53fe46291c89ec13c4c43e87192a0d1ed58cdbf54f4e5
-
SHA512
3f35d016fa6841e6227867e29a2168836f1b8d1d28164fb738220d88e6af5ed1a2caa1cce738b429a5e14f7e19b93b8429076746a538f1c9e2536c5de1506095
-
SSDEEP
12288:DgxxXwWvMXikxdMfL7wMnDJvQskQigfRsnC5gv/KeCCCofZZZ1ZliEXjdl47/1WN:iEdavwMnlQHPgIC5gv/KeCCCofZZZ1ZY
Static task
static1
Behavioral task
behavioral1
Sample
Order - 07876575.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
Order - 07876575.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bezzleauto.com - Port:
587 - Username:
[email protected] - Password:
Tommyduru8118 - Email To:
[email protected]
Targets
-
-
Target
Order - 07876575.exe
-
Size
696KB
-
MD5
3c7a5fd2797f25dde0e89456cc02bc36
-
SHA1
6e5e7b59c6433edaa3de647101d3832c1e8195c8
-
SHA256
9cca6b74cfa89d8505f53fe46291c89ec13c4c43e87192a0d1ed58cdbf54f4e5
-
SHA512
3f35d016fa6841e6227867e29a2168836f1b8d1d28164fb738220d88e6af5ed1a2caa1cce738b429a5e14f7e19b93b8429076746a538f1c9e2536c5de1506095
-
SSDEEP
12288:DgxxXwWvMXikxdMfL7wMnDJvQskQigfRsnC5gv/KeCCCofZZZ1ZliEXjdl47/1WN:iEdavwMnlQHPgIC5gv/KeCCCofZZZ1ZY
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-