General
-
Target
490f3b52a176c716bd0d0dca765b983e47b76c28b70e328f3e02d098540bf73a
-
Size
916KB
-
Sample
220521-awv4waahc7
-
MD5
e31cabd7a08ec8756645ed362a41924c
-
SHA1
c3e6fa7edc766755625fc8e8dc95812757486fc4
-
SHA256
490f3b52a176c716bd0d0dca765b983e47b76c28b70e328f3e02d098540bf73a
-
SHA512
7f590b9da07592bc208ad377b3410f7465eebfa2662fa6f60fd7a1ef47c93cea177ae8ac1fab996a4502926c6692b63dc97ffcc00399b7df36ca85cce7565488
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PURCHASE ORDER.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
[email protected] - Password:
connect
Extracted
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
[email protected] - Password:
connect
Targets
-
-
Target
PURCHASE ORDER.exe
-
Size
854KB
-
MD5
925ec4c511aef015d943d357fed38a78
-
SHA1
0d95b2c91d39b0c779a6b7c20aae5352b410f3f5
-
SHA256
07424ad0d92da73a502fdc7ad3c67ee6a7e882cbfd3abfad1cf4f33c4b5e4597
-
SHA512
bd5ebb1046e5378b9450d51e9d9931de6610ae5e00d62a028b9e4c058545ea858184a7699e65bfbe76d1c4b2c7f2e08a83e4ab621f67e8b341166e786a48d56f
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-