General
-
Target
9fbbc6024e3052aa1c1dbbaa7dbf5ef4f6c9b489b06a6dbfeab2d32a28d4facd
-
Size
479KB
-
Sample
220521-n533qseff6
-
MD5
b28542487de7f4070d9c721d8d4d9bec
-
SHA1
b0f9078c5121cdd642b47eb57cf323a8810f6a80
-
SHA256
9fbbc6024e3052aa1c1dbbaa7dbf5ef4f6c9b489b06a6dbfeab2d32a28d4facd
-
SHA512
57cad1fdd70d0fd2a04b18014caf49149f37258d472245e361d785e9c0929521b93edfe72fe418c86bbb6fc0d1cb16173bd996e82724a2b31576818e55ee057c
Behavioral task
behavioral1
Sample
PURCHASE ORDER.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PURCHASE ORDER.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
billions@cairoways.me - Password:
Whyworry90#
Targets
-
-
Target
PURCHASE ORDER.exe
-
Size
527KB
-
MD5
6379567925c7097a49aa88e9b0981f95
-
SHA1
ffb42a0da0e7855ecc339abb944f79e3597e6bd2
-
SHA256
10b2155331d3b0c7934808e52084c3911f82ece51f39836e3ef0e8db39ee9904
-
SHA512
c0b45c606cadd64144a9a0b8722582a045c7d3a358769e896b6d9245cfe3ee92bc7daab5d4459f3815bc12fc0e57d3582686cbb3dc73777e33f25f9396163c4f
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload
-
Contains SnakeBOT related strings
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-