General
-
Target
230a1efb69163ca1bc9bfbf2343b48eb4dbb0263860fcd48e8ae577c08754c16
-
Size
918KB
-
Sample
231213-bd7kmafcg9
-
MD5
4066fde3c127a29d0f71a79a80fe6d3e
-
SHA1
ca4759e21e735802186eb8c904e3a72daa21aba7
-
SHA256
230a1efb69163ca1bc9bfbf2343b48eb4dbb0263860fcd48e8ae577c08754c16
-
SHA512
e06e1806fabfa12dbb2838e8251e52b8e6b3d049eb7f478283024203f68cb7e524ae3a0ccb6198d2cc1d58afb49141807bf470bbbe08fbd44f832a7565b2f8a0
-
SSDEEP
12288:JWyzRXfVVacmd2nTDxoxOFR5Lp5KjpuSkbdeBPzzQ8xH0g:QyzR9VTmdKTDWxOdYpQpe
Static task
static1
Behavioral task
behavioral1
Sample
payment slip copy.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
payment slip copy.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
xySnlUr9 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
xySnlUr9
Targets
-
-
Target
payment slip copy.exe
-
Size
868KB
-
MD5
cf262eb3fb280d9eb218f99c724437ce
-
SHA1
ae94b55f84ddf2509d020ef59f7b81c04c524443
-
SHA256
cbfc4a113fb44f752bc2911f4e4cb78c7c03f673061c20ce31bc0c4cff6b85ec
-
SHA512
91019817d84976bbb1d651212b00f741e80aa3b57edfceba093c8ab7f2e27f24a49edadb968dffc21e432395933e34e74d628ff5cb69266702c054dce45cf566
-
SSDEEP
12288:0WyzRXfVVacmd2nTDxoxOFR5Lp5KjpuSkbdeBPzzQ8xH0g:nyzR9VTmdKTDWxOdYpQpe
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-