General
-
Target
QUOTATION_APRQTRA031244·PDF.scr.exe
-
Size
285KB
-
Sample
240424-kpajpsgb69
-
MD5
9d2813c3fe48db6f7cd2450a14ff0f65
-
SHA1
f039e86a0b12ce00afbc29d6683325dd4e354c55
-
SHA256
f5f93fd662d6d3d55c5c47ead5a931ed8eb8a066d9bd29113903506e7cf56fdb
-
SHA512
922a0e4341fcc622902f631e012ed186c91c7b752d9281171186953afca4801ca760f13dbb8bd237200b024eb6111cb1f04d73a1b0205ffab472112d422c0300
-
SSDEEP
6144:BS691E08tYLpZ0Egrdm4Vz0Rpppppppppppppppppppppppppppppd:BSalgrdm4Vz0RppppppppppppppppppX
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION_APRQTRA031244·PDF.scr.exe
Resource
win7-20240221-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
gator3220.hostgator.com - Port:
587 - Username:
[email protected] - Password:
RaFv@tsTUK55@@<<!! - Email To:
[email protected]
Targets
-
-
Target
QUOTATION_APRQTRA031244·PDF.scr.exe
-
Size
285KB
-
MD5
9d2813c3fe48db6f7cd2450a14ff0f65
-
SHA1
f039e86a0b12ce00afbc29d6683325dd4e354c55
-
SHA256
f5f93fd662d6d3d55c5c47ead5a931ed8eb8a066d9bd29113903506e7cf56fdb
-
SHA512
922a0e4341fcc622902f631e012ed186c91c7b752d9281171186953afca4801ca760f13dbb8bd237200b024eb6111cb1f04d73a1b0205ffab472112d422c0300
-
SSDEEP
6144:BS691E08tYLpZ0Egrdm4Vz0Rpppppppppppppppppppppppppppppd:BSalgrdm4Vz0RppppppppppppppppppX
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-