General
-
Target
PDAinvoice13DEC2023.r00
-
Size
605KB
-
Sample
241005-ph3n5asgrj
-
MD5
da1b2865864581d7c9cac5460cc23691
-
SHA1
8606b0ec551b6c131dc6ec0a524aa0ce9441ddfa
-
SHA256
998a4a4bad4c7eaa65953f3a35589cfbe594765efc51e40ee29f20c65f0cdbc6
-
SHA512
abdeee3f30998fc3186aef1106c05041279959322acf7366e78c61ea86b5960e6810bba351874be63847e66a08a13196aa7736414f9b7c48c9f2772e0d454257
-
SSDEEP
12288:JqeqKPAr86ofWlHoN0S7yet1qZ3r6xYWYvgSqeKtnGLXxWnDecWS5:J7qKPAr5hHg0kP1s38jsFqtGLkecT5
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.acestar.com.ph - Port:
587 - Username:
[email protected] - Password:
cssubic@12345 - Email To:
[email protected]
Targets
-
-
Target
JQL6kZuWTNlfWaU.exe
-
Size
883KB
-
MD5
a04865955d96e4b5b7d0d4105fc7424f
-
SHA1
f7c4f4164659d7196d540708c071b5a5657d1afa
-
SHA256
392fd8412e2fb96a3a9c54cd0aa32cf6c3bea21432e1ee46690412580055c214
-
SHA512
6ed9adbd80df77e3d94be0fd347e87feafb2306fa666c3118c73d3d458379a29c9f3c65436c0f91478a963e72abc81e6d4d80959c00c876e69554d1f34d1e32a
-
SSDEEP
12288:V+ltcuLojtRy1KUfEFxGuRgOJcLmSbXfYkesJ27n:VotcMcAhfERgOJafJ2z
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-