General
-
Target
f9dfdea138af9cd1731b42e069985ed90919b5ba8e3becb68664fbf68e383395
-
Size
265KB
-
Sample
220521-ndn5haded7
-
MD5
248ed96c59e9157b7ff756143cc8974b
-
SHA1
b0e2ef63d5eedd50a614710cb41d2be9d66dc3a8
-
SHA256
f9dfdea138af9cd1731b42e069985ed90919b5ba8e3becb68664fbf68e383395
-
SHA512
daa2330176a0b0f9cc4aca7b8a19e5b83d2a7fc2850ad1fe218c85d72ef0148910d41bc6488c2a7f0b02b08283106666703d56d284cd221fb332fe15771b357d
Static task
static1
Behavioral task
behavioral1
Sample
ORDER-PO-S.L 45675675.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ORDER-PO-S.L 45675675.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
anyanwu3116
Targets
-
-
Target
ORDER-PO-S.L 45675675.exe
-
Size
375KB
-
MD5
9f7f22f38c5f38233348579e446f2f99
-
SHA1
2ab49df0b27c6f944b4f098ac17c06ba1fdac8b0
-
SHA256
d07fd36c0c3bf16999c54f79b46e7647b7abbfa40aa410b1440e5261ef697a3a
-
SHA512
f759a02674c30bef9b2dd81975dfc9516460b3c9c1f4397f1c9ec5a8344a430f496034926973dec5de1fd2fa27b3408db9a1e9d5fe349af654ef0ec5847c5606
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-