General
-
Target
Proforma Invoices 388382.exe
-
Size
248KB
-
Sample
240513-25yd5saa84
-
MD5
e2e2483cbb49aceb57866f248537a32e
-
SHA1
7865c3376d7381b90efc2525edaeba2fdcf5dd79
-
SHA256
08503937d0b31fcc3e8410bb75291a864bf698adb08b34d0172c67979378d1dc
-
SHA512
842214f9ef70d61c15288665382ca90e7855fb56f451af4fb273c7ad8df3ca1d0a5370c0cd3f4b610e3c4ebe82627eb98839c58152b2bd511e0ce9907637557e
-
SSDEEP
3072:Mzca1dPK29ddNnCDDRvLGyrOAOkGt6+duWA/t/SHUebbxCbGgKk12qk/SPYm21KB:MzcaCKstvLGxOLbMUsK68H
Static task
static1
Behavioral task
behavioral1
Sample
Proforma Invoices 388382.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Proforma Invoices 388382.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
66.29.151.236 - Port:
587 - Username:
[email protected] - Password:
YuWsikfV67lD - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
66.29.151.236 - Port:
587 - Username:
[email protected] - Password:
YuWsikfV67lD
Targets
-
-
Target
Proforma Invoices 388382.exe
-
Size
248KB
-
MD5
e2e2483cbb49aceb57866f248537a32e
-
SHA1
7865c3376d7381b90efc2525edaeba2fdcf5dd79
-
SHA256
08503937d0b31fcc3e8410bb75291a864bf698adb08b34d0172c67979378d1dc
-
SHA512
842214f9ef70d61c15288665382ca90e7855fb56f451af4fb273c7ad8df3ca1d0a5370c0cd3f4b610e3c4ebe82627eb98839c58152b2bd511e0ce9907637557e
-
SSDEEP
3072:Mzca1dPK29ddNnCDDRvLGyrOAOkGt6+duWA/t/SHUebbxCbGgKk12qk/SPYm21KB:MzcaCKstvLGxOLbMUsK68H
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-