General
-
Target
Order_PO EM212843.zip
-
Size
474KB
-
Sample
221123-p7hegsdb87
-
MD5
7fa84662bea05257d91ec27e92495f6f
-
SHA1
caae301c43cdffda388c94df2022a7a732bc9330
-
SHA256
6eca2997c05f3312f3e704ce4363c74f3ba575ab0166dd6d16b5f5e6611cbfa5
-
SHA512
c59591c478b753e55aaa82d2ea479b57a212f6c3678278dacb7b013ec1f15b264f9b804df5b8264c5040a5f002ec3b30e7ff4befc0a4dfd822af388cc3c653f1
-
SSDEEP
12288:cn4xouOWe4Bcw7loOy+7OoGDL846WF9kB0gVL:cn+orOBrh9y+y3DLZFQ7VL
Static task
static1
Behavioral task
behavioral1
Sample
Order_PO EM212843.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Order_PO EM212843.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.strictfacilityservices.com - Port:
587 - Username:
[email protected] - Password:
SFS!@#321 - Email To:
[email protected]
Targets
-
-
Target
Order_PO EM212843.exe
-
Size
572KB
-
MD5
e10777c560dcacc0537c588c2999bd7d
-
SHA1
127b2a6444a323070ec31643dabfa3803ffe2ec5
-
SHA256
5b72b74c569f9a1593b4bf313a02db7e10f9e8ffb5ed73ee73ed76b1c53ad13f
-
SHA512
9339898e57c77be6966a1cab1fb39860b720e762fabcbfc8c21ebf5d3995b4c907910536eb0415a404dce2e9d06dc5176d2ef6b8e1620370556798a7825eafb8
-
SSDEEP
12288:Ox3aWpUo67IMwM8yzwElEkj76s4DSABfUnNI1ic6DlQOys7OoG7P8M6cFmX3Z7i:l6s4DSuUNEiT5Fysy37PjF6l
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-