General
-
Target
Lista de embalaje y dirección de DHL.bat.exe
-
Size
77.0MB
-
Sample
240913-qph4qssgmf
-
MD5
a2eb0cef8229b46e9b9a326289f9b25a
-
SHA1
ac18afedea384ff1fa3294c19fb05e20bb13966b
-
SHA256
3db464cfb18f44f0bd814e59789a76363c0db090afd595add448f8ca802284e2
-
SHA512
067f218450301f1d4b40214a42a9b85105d3c528d7056a335e043f44e756622bc1b6345a4135ebcc182516ff62414af3c73747563c5b95c8af713e0bf5a3fcc3
-
SSDEEP
24576:e4lavt0LkLL9IMixoEgea+rsiDPP/q9MmCS:Jkwkn9IMHea+zDPaPCS
Static task
static1
Behavioral task
behavioral1
Sample
Lista de embalaje y dirección de DHL.bat.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Lista de embalaje y dirección de DHL.bat.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.flujoauditorias.cl - Port:
587 - Username:
[email protected] - Password:
l;0jGu7J;z_a
Extracted
agenttesla
Protocol: smtp- Host:
mail.flujoauditorias.cl - Port:
587 - Username:
[email protected] - Password:
l;0jGu7J;z_a - Email To:
[email protected]
Targets
-
-
Target
Lista de embalaje y dirección de DHL.bat.exe
-
Size
77.0MB
-
MD5
a2eb0cef8229b46e9b9a326289f9b25a
-
SHA1
ac18afedea384ff1fa3294c19fb05e20bb13966b
-
SHA256
3db464cfb18f44f0bd814e59789a76363c0db090afd595add448f8ca802284e2
-
SHA512
067f218450301f1d4b40214a42a9b85105d3c528d7056a335e043f44e756622bc1b6345a4135ebcc182516ff62414af3c73747563c5b95c8af713e0bf5a3fcc3
-
SSDEEP
24576:e4lavt0LkLL9IMixoEgea+rsiDPP/q9MmCS:Jkwkn9IMHea+zDPaPCS
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-