General
-
Target
NEW PURCHASE ORDER FOR JANUARY 2021 #02453.exe
-
Size
443KB
-
Sample
211201-pbfwsabhdr
-
MD5
50dec39b9fc88b00ce024d65b35e1038
-
SHA1
f9ab13a600bb3a8d2c0c83e89951fb88a314df22
-
SHA256
3d078815c5f303d119acfa9841d049f26deeaa17870964900f9767071fc00c18
-
SHA512
242380c3cf85b952ff014cf148d1c8a17b4e06cc1ee25024a7bf94c712da39df1b0af8106570f42b43d182d1a2234e8a3849cff63f53537e0974c0b75d38069c
Static task
static1
Behavioral task
behavioral1
Sample
NEW PURCHASE ORDER FOR JANUARY 2021 #02453.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
NEW PURCHASE ORDER FOR JANUARY 2021 #02453.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.humbleenterprisesconnect.com - Port:
587 - Username:
[email protected] - Password:
ccNkxJ@2
Targets
-
-
Target
NEW PURCHASE ORDER FOR JANUARY 2021 #02453.exe
-
Size
443KB
-
MD5
50dec39b9fc88b00ce024d65b35e1038
-
SHA1
f9ab13a600bb3a8d2c0c83e89951fb88a314df22
-
SHA256
3d078815c5f303d119acfa9841d049f26deeaa17870964900f9767071fc00c18
-
SHA512
242380c3cf85b952ff014cf148d1c8a17b4e06cc1ee25024a7bf94c712da39df1b0af8106570f42b43d182d1a2234e8a3849cff63f53537e0974c0b75d38069c
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-