General
-
Target
QUOTATION_MARQTRA031244úPDF.scr.exe
-
Size
2.4MB
-
Sample
240328-p73enaeg2w
-
MD5
749404f8b6bd72307f017d1fd8f3081e
-
SHA1
84995cbfec91c10df85c97d0f7acec531dba455c
-
SHA256
aa5e905630fdcd343ea0c1bdc41c67ec3b60abcab50f2ed7bcfba931e7d30f11
-
SHA512
1be07e218ebbe3750c0a62d2ca69bd3be19732fcb99452e7df111df79bccd5039893b37fd8ab31af1ba27b1c40ec90efa3803b6b2023141ce496c033b8dfd112
-
SSDEEP
49152:i5L4P8xfttrOoXDhNkxtOTBcziRLhT2vWkYd9n:OymFtrOGhNkxY9RcOkY
Behavioral task
behavioral1
Sample
QUOTATION_MARQTRA031244úPDF.scr.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
QUOTATION_MARQTRA031244úPDF.scr.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
gator3220.hostgator.com - Port:
587 - Username:
zam90@aoqiinflatables.com - Password:
VvMMgD#w!TZmaka!@ - Email To:
zamgets@aoqiinflatables.com
Targets
-
-
Target
QUOTATION_MARQTRA031244úPDF.scr.exe
-
Size
2.4MB
-
MD5
749404f8b6bd72307f017d1fd8f3081e
-
SHA1
84995cbfec91c10df85c97d0f7acec531dba455c
-
SHA256
aa5e905630fdcd343ea0c1bdc41c67ec3b60abcab50f2ed7bcfba931e7d30f11
-
SHA512
1be07e218ebbe3750c0a62d2ca69bd3be19732fcb99452e7df111df79bccd5039893b37fd8ab31af1ba27b1c40ec90efa3803b6b2023141ce496c033b8dfd112
-
SSDEEP
49152:i5L4P8xfttrOoXDhNkxtOTBcziRLhT2vWkYd9n:OymFtrOGhNkxY9RcOkY
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
PureLog Stealer payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-