General
-
Target
Order - 07876575.zip
-
Size
556KB
-
Sample
231212-pcv24aecb5
-
MD5
df6af0da8151924d8235f3804d358b50
-
SHA1
401c9d94edf80249ec13560781c6f88940ae39eb
-
SHA256
56f839dc0ef9bc1a4c759d6869ce03263b82772d72d2c2899fb8e0ffc450b89a
-
SHA512
8ca6dda9152dd57369eb0e6c7ce5bca75bab1b211d65bedada6088f097bba966e1108b4a6826db24b7c61afd34e964b17e6d7a39c01a7d4da3e959595ce18de7
-
SSDEEP
12288:qshlWNxwWvMbi4TdMff477bCnDbvOskQavdNCJoJ:qsDldaA73Cn3OHndNC6J
Static task
static1
Behavioral task
behavioral1
Sample
Order - 07876575.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
Order - 07876575.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bezzleauto.com - Port:
587 - Username:
[email protected] - Password:
Tommyduru8118 - Email To:
[email protected]
Targets
-
-
Target
Order - 07876575.exe
-
Size
696KB
-
MD5
3c7a5fd2797f25dde0e89456cc02bc36
-
SHA1
6e5e7b59c6433edaa3de647101d3832c1e8195c8
-
SHA256
9cca6b74cfa89d8505f53fe46291c89ec13c4c43e87192a0d1ed58cdbf54f4e5
-
SHA512
3f35d016fa6841e6227867e29a2168836f1b8d1d28164fb738220d88e6af5ed1a2caa1cce738b429a5e14f7e19b93b8429076746a538f1c9e2536c5de1506095
-
SSDEEP
12288:DgxxXwWvMXikxdMfL7wMnDJvQskQigfRsnC5gv/KeCCCofZZZ1ZliEXjdl47/1WN:iEdavwMnlQHPgIC5gv/KeCCCofZZZ1ZY
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-