General
- Target Invoice To Be Reviewed.GZ.exe
- Size 1.1MB
- Sample230617-ql79fsbh39
- SHA256 d94624f2966882c4d9e35e0cdfe4e40963f22148c43a946867c63f5fd68ff401
- MD5 0be15fc7dd2ce7e4568dc0d20041f97e
- SHA1 74d5769f8a538157e76eeda74e1171e64b11791c
- SHA512 511ac8e5ddd09b6715cde335880ddbc032d182ed43412db57c7e12a72a032c89a3d7b15b0547f2ba7db7c903c2351d958a6048cf67c8fcaba3246d6dade65bc1
- SSDEEP 12288:zf6c0jpZTsd3fH6w2TvQe64P9z7oM0m6+P5AunPrw6Chu:r6JjpFsxfHyvQt4P94Mg+3P
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Invoice To Be Reviewed.GZ.exe
Resource
win7-20230220-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Invoice To Be Reviewed.GZ.exe
Resource
win10v2004-20230220-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.expertsconsultgh.co
-
Port
587
-
Username
-
Password
Oppong.2012
-
Email to
Targets
-
- Target Invoice To Be Reviewed.GZ.exe
- Size 1.1MB
- SHA256 d94624f2966882c4d9e35e0cdfe4e40963f22148c43a946867c63f5fd68ff401
- MD5 0be15fc7dd2ce7e4568dc0d20041f97e
- SHA1 74d5769f8a538157e76eeda74e1171e64b11791c
- SHA512 511ac8e5ddd09b6715cde335880ddbc032d182ed43412db57c7e12a72a032c89a3d7b15b0547f2ba7db7c903c2351d958a6048cf67c8fcaba3246d6dade65bc1
- SSDEEP 12288:zf6c0jpZTsd3fH6w2TvQe64P9z7oM0m6+P5AunPrw6Chu:r6JjpFsxfHyvQt4P94Mg+3P
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext