General
-
Target
Shipping Document(Invoice and packing List).rar
-
Size
598KB
-
Sample
231212-r1bpgaefbj
-
MD5
2a79126d51f26d751b45d57da3f55486
-
SHA1
a170e2962a07c6d387be69162a3ff6959991acc1
-
SHA256
ee78e1c332cbfd5252ba3786ad0c5e2c91ccc6dd67b7dbf1bb05ae83847784ce
-
SHA512
e86c9142b5f80351f7f39410789d3abd51e34ad3a237a2588cde2eb4292e98c8dbfbc5947e9b03c54df2341de1651b356fb29c6f636be21c6f50e90426124b2d
-
SSDEEP
12288:OjR8dnhC5gggJt2c/hxXkJbwAamfnKXeTv28fVTVEYkln:O2dkdodXkJbwAamyXgv2gV5uF
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Document(Invoice and packing List).exe
Resource
win7-20231023-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.mercuresurabaya.com - Port:
21 - Username:
[email protected] - Password:
2ffPmXZ_5A{G
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.mercuresurabaya.com - Port:
21 - Username:
[email protected] - Password:
2ffPmXZ_5A{G
Targets
-
-
Target
Shipping Document(Invoice and packing List).exe
-
Size
623KB
-
MD5
eeed55c1a8b08bdc4182dc64df59e70a
-
SHA1
e8e414a927bd08a6b1213a62c9d21cfc7efb7ee6
-
SHA256
70a65c589b3b46ed049d952785c5f21d709c7b1558bce2b0646e54927a93da38
-
SHA512
4024acc30b4def53293114f2cf25057a515affd337824609749468a7055002be7682f4324a7c21c6c27c73446ef61e49f6148acf7e1d382c13b637ff86c74050
-
SSDEEP
12288:u3IU8S6eUd5MxSudIbhFBGooic4jS9F8caGpS3mNbsD2og/VhEPErnnWka:kItSAd+xSuWbBoi/O9F8caubsDtISEz2
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-