Overview

overview

10

Static

static

Purchase O...df.exe

windows7-x64

3

Purchase O...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Purchase Order_2241838_20221210_201349-pdf.com.gz

  • Size

    8KB

  • Sample

    221210-qxdtzsff22

  • MD5

    6a82a31e4abd5d2f4e9904cae5493bac

  • SHA1

    06339ece8380763616a976350b89b63347f2f30d

  • SHA256

    e6339d90cb2b3178d49c4dc5a9f0b1bb0bbef8cbe78d7c8a64f7080f0d0eda32

  • SHA512

    793de4a772debc31f1dd332486c868034e67a8efaad60bb0a4baa18c984faa0d8502cba7c700455544ae2ee4977aa594cea393b1ea4cf851c3573c6d38c7bb49

  • SSDEEP

    192:AEIacfTcW/knXaREkwa66hAkuJ1L2HtQ5PiCQSVkMRciM5b:ARTfoNXaRXHOkC26oBaR+

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://discord.com/api/webhooks/1050604372649857074/HCdXn7L3pXjiWpMvSwsznc6mxCQNPxPKiBRfn4IJaLSoWiI7oFa4ZtErxOdAdlW9nPsH

Targets

    • Target

      Purchase Order_2241838_20221210_201349-pdf.com

    • Size

      23KB

    • MD5

      e21cdaf4693263a36d6f3f6d7544bc19

    • SHA1

      91d37dac1d4669e0fc704ddbef4ffae00534d826

    • SHA256

      3e00d864918670e82b26e4dd616644aa3c22ead3495ec6ca6e2588e6a855aad8

    • SHA512

      d636f89d776e57f5eb2905825cc182664c03402cdf864bc8d9573c8dfa981b2952f95777d704ce55caa152a7b10957b7fd38d3738531c87a48b859992cc20a5a

    • SSDEEP

      384:xYglR6cNoHzVZJq/S8frSo62tCT+UuSvwiFawJQl:xX4HzIfrS8fiFaKQl

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks