General
-
Target
fa61a134438c66f30b00e6f93ac643c5aeeaf27fb75e0a9d0e4055f076395f73
-
Size
754KB
-
Sample
240727-bf7cmszcnd
-
MD5
47583d077a426eaf2b5ada4f4b07a869
-
SHA1
a96596817ab869533fbbfd95332efa762511eaa7
-
SHA256
fa61a134438c66f30b00e6f93ac643c5aeeaf27fb75e0a9d0e4055f076395f73
-
SHA512
a41f1a140f2be282e660da2b194e0fb182de511d0df1c274c63074c0378cd4bc309eb34ed581496d055dc1ec0afc394ec2f694681aefbab6e968f7c6310f5e0e
-
SSDEEP
12288:z+ReIkKk/WkhYdiezKqNveCvwuBvUO/7P8+ioTlwTJ9eZvAFnHodEEeeUX+6:xIrssZECvwuBMO/D8+iEEJ9e8nHoSEej
Static task
static1
Behavioral task
behavioral1
Sample
Receipt of payment 03744 PDF.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Receipt of payment 03744 PDF.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
Receipt of payment 03744 PDF.exe
-
Size
1.2MB
-
MD5
7a751bcda4f85feadb5073f1b21eee43
-
SHA1
0f92303453d3ed5ee087e5b65099962182a842ee
-
SHA256
11249774e541685aa3eed7d7fc58cc8d10491180760637c7e6d2868d909078eb
-
SHA512
f87d3960b9b6eaf6fe9ef46ba06bfe050ff17f2a0f0188b14433199f3044d59192f1fbf8c1ce560733ed250389738a6290580f049371061183f6f2b50923a7c5
-
SSDEEP
24576:NqDEvCTbMWu7rQYlBQcBiT6rprG8aJw8+mgYx3eIZHM+eeew7:NTvC/MTQYxsWR7aJwbux3eIC+eHw
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-