General
-
Target
Purchase Order.exe
-
Size
338KB
-
Sample
211022-ge6ydabbf5
-
MD5
392f0e8e6ed60e4e1c35bf1f6be5ec57
-
SHA1
72aff1f262792ec3e626888583c55549d395dcb7
-
SHA256
49b6ab1d5d071bdca6b3cfec673a258110848bc5beea2805d6b7e016731a4655
-
SHA512
a67341f726f1e0df2e1733cf3d4dbcbb6d950922b35df5c2ba1feec343dc668a28b3f9ee0a8eb9089fa3e04811acb868dc34021d38f2b9d1fb2a987d08410532
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
Purchase Order.exe
Resource
win10-en-20210920
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1803146213:AAHYyCRx7FggQ9LfPbrIs79ZUWCEc9wNnDo/sendDocument
Targets
-
-
Target
Purchase Order.exe
-
Size
338KB
-
MD5
392f0e8e6ed60e4e1c35bf1f6be5ec57
-
SHA1
72aff1f262792ec3e626888583c55549d395dcb7
-
SHA256
49b6ab1d5d071bdca6b3cfec673a258110848bc5beea2805d6b7e016731a4655
-
SHA512
a67341f726f1e0df2e1733cf3d4dbcbb6d950922b35df5c2ba1feec343dc668a28b3f9ee0a8eb9089fa3e04811acb868dc34021d38f2b9d1fb2a987d08410532
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-