General
-
Target
21052024151621052024invoice.rar
-
Size
637KB
-
Sample
240522-xswybsda7z
-
MD5
bb43731cef3397b7f56fef67ab020274
-
SHA1
a5c40aa7ed73278cc60aec884f5329a2aa0df867
-
SHA256
96866b48df1c0395bad3fbc22d472d2bf007e9f650e87d695070f14231181601
-
SHA512
42eaa42cec7711c4ad9ce1ccb4e4f5ce280795cda00f589b9f92f6e0b14ca686a51a93b8e843b82ac74bd717d9f9c4237220c477cd78438659b819f5378fae9b
-
SSDEEP
12288:iZUXNslC8bTuaj+91XfmpooZfbddbSIPB/2I/npunl7hjlr3pIusKG1xCsCyDk7P:iZFCuXi5EjLSSB/2IUN3jJTsrGw7E
Static task
static1
Behavioral task
behavioral1
Sample
invoice.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
invoice.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.ipr-co.org - Port:
587 - Username:
[email protected] - Password:
IPRco@100102@ - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.ipr-co.org - Port:
587 - Username:
[email protected] - Password:
IPRco@100102@
Targets
-
-
Target
invoice.exe
-
Size
662KB
-
MD5
7e25fcb83e6c246f1db8539c26379f68
-
SHA1
9387dd1db20f1d643437ddc90e2f227ce667ab99
-
SHA256
92f372371d773e499445538a7f978fe16dc03bf772adf1151dc998a7916b284f
-
SHA512
20f5d204b73021c7b6fb55d8e19b2d2533b214a2f5697019c0af5a60b047f7e8494dfc442ae6f4115d78789223e6080a8e36c5946f73d0b9ebae63c40e903006
-
SSDEEP
12288:plYifTEb5syskpi7Ar7CiiYN3Q40CfT7VkxSs5sRVbEbYstXM5y:kiI5NsAr7CirN10C7eB5sR2cst8w
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-