General
-
Target
9a45555b12e22df5cf9ca0afb95a87ad9fbe724722cf06a6237382b552562b41
-
Size
470KB
-
Sample
220521-cx4thshgbn
-
MD5
51e64cafdef3c3d2e7624fdfa8bc7012
-
SHA1
3b18a10eb48cf41c14027560f27878609bd90a35
-
SHA256
9a45555b12e22df5cf9ca0afb95a87ad9fbe724722cf06a6237382b552562b41
-
SHA512
6271113c161acac7d2855dfcda6d0f4d9d31d87ef32343ceba7a27345b2df08333e4c86d5465e0544c38c78dd54f163b53b46b506ad7c2fced966b6db501d6a4
Static task
static1
Behavioral task
behavioral1
Sample
purchase order.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
purchase order.exe
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
purchase order.exe
-
Size
417KB
-
MD5
42bfacca440c09d0d3797936fd1473cd
-
SHA1
8b83f3b7373e0e3beddee5ccf4f7e8e765761c90
-
SHA256
2ee560a991356dbcf4f398a7db1e8258c0fac8fbc0f938ad03f6a6d00810aacb
-
SHA512
c932abf10bc42b0fe2fbb9b4cd42101fd7d285b12445d5e9b72c04d10c26f9a9b7b82465c42138465d7737f31924d079850d700b0de06a25dbf160271a4a4fa3
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
suricata: ET MALWARE AgentTesla Communicating with CnC Server
suricata: ET MALWARE AgentTesla Communicating with CnC Server
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-