General
-
Target
Remittance_Advice 26042024.exe
-
Size
837KB
-
Sample
240426-jze2hacd47
-
MD5
f78fac7fbb75ddcc67dd7cb5b6b6ea97
-
SHA1
a9b9c8f3121cb128882d3e59b7ba2b045ce0792f
-
SHA256
cd3e530bfaf604d4e59e78d8d8761ab63f0d3d57beff38c1f4802993226af6bb
-
SHA512
ec39ce438175b8e431f28ec559f707fd631c66f7e9c4160e28639e12930be14163439b2f03b834433cf1cebcad0e87fa93028ce70148103bff09ee664970341c
-
SSDEEP
12288:9bqnHvjNIrpf9rN/mc/CbTrMSrJjxddkDEb8LjkyUtGWpGwvNqKdzPjzow4bkR:9uPjKr5BNDKvBn0kySRpGwoKFzow7
Static task
static1
Behavioral task
behavioral1
Sample
Remittance_Advice 26042024.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Remittance_Advice 26042024.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.innomedjsc.com - Port:
587 - Username:
[email protected] - Password:
s]~5ai)IFpr- - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.innomedjsc.com - Port:
587 - Username:
[email protected] - Password:
s]~5ai)IFpr-
Targets
-
-
Target
Remittance_Advice 26042024.exe
-
Size
837KB
-
MD5
f78fac7fbb75ddcc67dd7cb5b6b6ea97
-
SHA1
a9b9c8f3121cb128882d3e59b7ba2b045ce0792f
-
SHA256
cd3e530bfaf604d4e59e78d8d8761ab63f0d3d57beff38c1f4802993226af6bb
-
SHA512
ec39ce438175b8e431f28ec559f707fd631c66f7e9c4160e28639e12930be14163439b2f03b834433cf1cebcad0e87fa93028ce70148103bff09ee664970341c
-
SSDEEP
12288:9bqnHvjNIrpf9rN/mc/CbTrMSrJjxddkDEb8LjkyUtGWpGwvNqKdzPjzow4bkR:9uPjKr5BNDKvBn0kySRpGwoKFzow7
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-