General
-
Target
20220829_PEDIDO_22073M_PROTECO_LIMPIEZA_Y_KITS..exe
-
Size
1.1MB
-
Sample
240429-r2eshsdd5s
-
MD5
271556a6e502efc394f570f3c57c8596
-
SHA1
74c9c4d81c32f7e2c0b4cdc0a21bc916255b7249
-
SHA256
58d1cf060d10e302a7cb4527dbbbc547311e5166e0a34871356024c444ee441d
-
SHA512
dcf7c92c8aa85518edddb95b01935b805fb59b36c7c8b013ae51fa6afc176fb9657fa731dfb421193d0b433f0ea139de2aeeec96d48673866f69b71410826735
-
SSDEEP
24576:rqDEvCTbMWu7rQYlBQcBiT6rprG8atQ3XBrIgKm3pW:rTvC/MTQYxsWR7atQ39I+Z
Static task
static1
Behavioral task
behavioral1
Sample
20220829_PEDIDO_22073M_PROTECO_LIMPIEZA_Y_KITS..exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
20220829_PEDIDO_22073M_PROTECO_LIMPIEZA_Y_KITS..exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cash4cars.nz - Port:
587 - Username:
[email protected] - Password:
logs2024! - Email To:
[email protected]
Targets
-
-
Target
20220829_PEDIDO_22073M_PROTECO_LIMPIEZA_Y_KITS..exe
-
Size
1.1MB
-
MD5
271556a6e502efc394f570f3c57c8596
-
SHA1
74c9c4d81c32f7e2c0b4cdc0a21bc916255b7249
-
SHA256
58d1cf060d10e302a7cb4527dbbbc547311e5166e0a34871356024c444ee441d
-
SHA512
dcf7c92c8aa85518edddb95b01935b805fb59b36c7c8b013ae51fa6afc176fb9657fa731dfb421193d0b433f0ea139de2aeeec96d48673866f69b71410826735
-
SSDEEP
24576:rqDEvCTbMWu7rQYlBQcBiT6rprG8atQ3XBrIgKm3pW:rTvC/MTQYxsWR7atQ39I+Z
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-