General
-
Target
INVOICE and DETAILS.zip
-
Size
609KB
-
Sample
231212-r1ar6sgcg5
-
MD5
7e04c9b66a749fd4f23ff6bbfdd3d98f
-
SHA1
7df6cbc2b540d46b99c70e28c7a204d29936a594
-
SHA256
0e55186ae31eb9531c4d875e905f4f5021bea9620308afdcdfb2907f0ce2a269
-
SHA512
e5c15f432336580289b9ae30bbde1759da7dc00fe77be06a2f7b19ce7e4ad2bccda4a0394b550f8ac96b40c3654851ea8a56dc1381dadbf46f94de3e52bde87b
-
SSDEEP
12288:MAVmIVAUgYoRUf/KI4/DECGe/9LelIOB49sNWqAz1uMCEjDTDddfOS:M6tCU6+qHbEfe4B46NWxz4VEjD3P2S
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE and DETAILS.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
INVOICE and DETAILS.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.precise.co.in - Port:
587 - Username:
[email protected] - Password:
Singh@2022$ - Email To:
[email protected]
Targets
-
-
Target
INVOICE and DETAILS.exe
-
Size
638KB
-
MD5
ebb74a0fae5bf676cc2db601c2524ece
-
SHA1
53194206f72983e5cdc408a885c8b549c395e286
-
SHA256
f3e9ff06f04b6f3fce67e3ae02f89eb6f006ae95391105703abded87bc53f362
-
SHA512
b98cdaf7b00d19ccb074939d8b1a378937e41b9f38219de88c1166ef7643687341df8c72b6159cd59084b4db1a0fbf15ae91bebce8043bbceeabe8f287410ec2
-
SSDEEP
12288:LkBgOWP6i9oGpby1sTr55RxD0yaxc0q64ZKNWqAzLuMC2jDTDPGNnjl:gCMGpSsTr55R90yaSF64wNWxzaV2jD3G
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-