General
-
Target
order confirmation.rar
-
Size
538KB
-
Sample
220930-qlm9aaeeer
-
MD5
b07674864accbdbde106659ef0c45739
-
SHA1
1bacd4f55d14aea5d25df0cb542c4867210f3aad
-
SHA256
2fbdede39c8b37d10ed6bcb0520ec45334cd94649b4760640e7ac27c7a6d06bf
-
SHA512
91022befcf0fadd37f5555f6749d60d3d998b2931b3a91deb9000c82968122da7ff4fefe4b3e39408a5c69579bcbfcba02900cf59c0e3f9f5488f01e9ce7e712
-
SSDEEP
12288:qTN3ctVTo7+Ftei8VhzdtZ+vNhwZrm3YIkVqQdkbNSsn9hgptbTyd:qTirxoVhz7Z6h0FdkbNS0DAtbTyd
Static task
static1
Behavioral task
behavioral1
Sample
order confirmation.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
order confirmation.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5662683474:AAFvSjyPXTiwhBPcFi8of3_-_FCdfhhN8x0/
Targets
-
-
Target
order confirmation.exe
-
Size
972KB
-
MD5
b92f1e453834755986777a5bd5dc1d5f
-
SHA1
5751c9c918bc41c0e455dc81d8563687d3d981fb
-
SHA256
4084110bd1fa032556c1f16a3850f492716a343616f2eb27015d1f654ff1b9c8
-
SHA512
cccb9c4a8addaaf3a8048da50dc9f62b307cd3a23324a5ad9115b484d0190beee3909846bcbc37fe8993d1c3f079ec6a3e8c00bed2b7c2910dd04100d8d3a12c
-
SSDEEP
12288:PIo2Bn24peLKtzfWYCPsqScxtngS3xBADqjJ5npZxHgTW0P35Y5I/3f5eQFR3PAP:PIfB2VLKNWYCPLN9rjrzxIW
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-