General
-
Target
0b72c16a7d6ba38f65db4fdd1e78a734a0c1c8892b391bb16ad17503129be0a1
-
Size
665KB
-
Sample
240426-cgh7wahb7t
-
MD5
2dd1b5725b0eaf0db26a9c470889faf2
-
SHA1
7a9607402529a80cef858d0623cc1fd58cdbc9b5
-
SHA256
0b72c16a7d6ba38f65db4fdd1e78a734a0c1c8892b391bb16ad17503129be0a1
-
SHA512
2684f809fcafb52d720040a1f202e86b565431f237a84c0f764340b817e22bd878970e849b25f99368cc0a04e290939aa6688c757752dc43001e9203506c5458
-
SSDEEP
12288:vxAn2yPXMs3xLChH919Cdj4A05ZNFIrdYrpKda0rlBcKQSOejuk:vxAn2yPxpChH/Ne5YQrlBcaf
Static task
static1
Behavioral task
behavioral1
Sample
Remittance advice.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Remittance advice.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.albushrametalic.com - Port:
587 - Username:
mustafa@albushrametalic.com - Password:
GLBL1285# - Email To:
successbright053@gmail.com
Extracted
Protocol: smtp- Host:
mail.albushrametalic.com - Port:
587 - Username:
mustafa@albushrametalic.com - Password:
GLBL1285#
Targets
-
-
Target
Remittance advice.exe
-
Size
704KB
-
MD5
0213307d4a5c33c73fc8763498a054e5
-
SHA1
2c6978c737ad7b1a9547ed3365fef15996d98137
-
SHA256
6266398586cea7e8cc4154202bb9f5541b1a6b6b5640f0efdd2f2ef9e82c7ae6
-
SHA512
154fe0dc2e3184304ccdc360e9d10c025017b318998d405e9a8e74dc8161e40e1493aede3e8efcd412e62770dc6cc5c0afb26d5b1685ac0b692cfbf8c1aa8c62
-
SSDEEP
12288:sWYIPXjxannnHg2SPMey7LKykiCjOkOt5hNF4rdYJpklo0rlBtVpd7kqD+:sWYIPFannnHg2SonkjOkiNS5YwrlBtn4
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-