General
- Target PURCHASE ORDER.exe
- Size 491KB
- Sample221122-rjed2aae4t
- SHA256 147b034ddfd353fa772f1d1cf91625013fc1e1f0620d3f1a859fa96f7b7cc9cf
- MD5 dc85ffa9d1a73663274aa89f3eb195e5
- SHA1 3cef598ac69d88e736998d9f082abeaa04be7c91
- SHA512 6a1551b39d8723b75849ca1819d92dcdd1c0ec48f96f4ea920cd85e917e3469c02a92a9095d4d4f3ebe95acabc3d84845e780aed1574a24ad005e2a72c7f988e
- SSDEEP 12288:LNSgdAEU2ABY4Hyym0SMxio2wDe6oX3H3:RhdAC4HynMxi0DdoX
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER.exe
Resource
win7-20221111-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
PURCHASE ORDER.exe
Resource
win10v2004-20220812-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.svcnc.com
-
Port
587
-
Username
-
Password
Krupashine@6791
-
Email to
Targets
-
- Target PURCHASE ORDER.exe
- Size 491KB
- SHA256 147b034ddfd353fa772f1d1cf91625013fc1e1f0620d3f1a859fa96f7b7cc9cf
- MD5 dc85ffa9d1a73663274aa89f3eb195e5
- SHA1 3cef598ac69d88e736998d9f082abeaa04be7c91
- SHA512 6a1551b39d8723b75849ca1819d92dcdd1c0ec48f96f4ea920cd85e917e3469c02a92a9095d4d4f3ebe95acabc3d84845e780aed1574a24ad005e2a72c7f988e
- SSDEEP 12288:LNSgdAEU2ABY4Hyym0SMxio2wDe6oX3H3:RhdAC4HynMxi0DdoX
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext