General
-
Target
Proforma fatura.msg
-
Size
49KB
-
Sample
240223-pb4ylsga55
-
MD5
36295a4ab503049b1440a9f055697f0d
-
SHA1
ea0ef251142eab81978cd972415810d7c0d6f02d
-
SHA256
307119554d57a79005b8b76c692ff226ca961b17f7f9ad0d43590556632d3745
-
SHA512
37ade30a49967a1f358c2b888f66181e1a8158ceeddcb81c55e0aa44923764b12fc4cb8a51988a42dd2a56c0f33119a8eed76afcc4e7709372fb3cc4febd095a
-
SSDEEP
768:1GuV05mXur1ABsZLSB8CA0J3sKHsK99Rh5ETBsIwIDpa:fe4ZhPBh5ETBsYp
Static task
static1
Behavioral task
behavioral1
Sample
Proforma fatura.msg
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Proforma fatura.msg
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
Proforma fatura.png
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Proforma fatura.png
Resource
win10v2004-20240221-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6981023497:AAHl8hNT6c3ywQtrLSswit8gBAF4M9xCAZU/
Targets
-
-
Target
Proforma fatura.msg
-
Size
49KB
-
MD5
36295a4ab503049b1440a9f055697f0d
-
SHA1
ea0ef251142eab81978cd972415810d7c0d6f02d
-
SHA256
307119554d57a79005b8b76c692ff226ca961b17f7f9ad0d43590556632d3745
-
SHA512
37ade30a49967a1f358c2b888f66181e1a8158ceeddcb81c55e0aa44923764b12fc4cb8a51988a42dd2a56c0f33119a8eed76afcc4e7709372fb3cc4febd095a
-
SSDEEP
768:1GuV05mXur1ABsZLSB8CA0J3sKHsK99Rh5ETBsIwIDpa:fe4ZhPBh5ETBsYp
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
-
-
Target
Proforma fatura.PNG
-
Size
7KB
-
MD5
b8b637cb0bce40a5bfa4ee480016e73d
-
SHA1
ec25504dba1dc470f7e3c2391ffa799d6de97b6a
-
SHA256
422d39122b002e41f18a2f0045ac9dd187fcca567cfae4482f0f6f77e9cdf6d9
-
SHA512
ffea9772d151b4d606f3a0e4e6a705b587b0ac4153a3cf63a725abb785ea813cdd11bbd6a7fb0735798501dc3128f7afe88866e2d2733088e551c8414bdfbcc7
-
SSDEEP
192:vaHZD1oYEotG1MY5vYl+mIm9IvkmheX/ymYDn:6ZDyYE0+MYsIwIvkmheXqVn
Score3/10 -