General
-
Target
ORDER.zip
-
Size
397KB
-
Sample
230328-h3zpmsbd2w
-
MD5
260294070d43ee5907a035b9ff4fe50f
-
SHA1
91ca0442ca61643c48a9a3d8dbe12fe22bedbf91
-
SHA256
211d7ccda5b7c2b125706af35b4e921fec0f9589382b82d3c912ba1beb888a85
-
SHA512
9e7e66788bcf8fab2c5c9820381ac3372240d34f85fb67c0f9f5e2290ca53ce1c77a7007821796790128317633a8ba78565ca5ec24962bd330ad9b3a7058b88a
-
SSDEEP
12288:tg48ZHFMyr8AJme7dEu7DJT1wwWoERIflOCT:tgZHFMyYje7dHDpWwWoER+Oo
Static task
static1
Behavioral task
behavioral1
Sample
ORDER.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ORDER.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.southernboilers.org - Port:
587 - Username:
info@southernboilers.org - Password:
Sksmoke2018# - Email To:
obtxxxtf@gmail.com
Targets
-
-
Target
ORDER.exe
-
Size
592KB
-
MD5
7894e9970e32d04a35c1930e48e5afda
-
SHA1
6b06ac325aed4b6038e1a95cbac18941a5d71f43
-
SHA256
c150db08e8b3f241cb1ea3a82a15af0ed3a86f15f2e12f544f0731c8785a0405
-
SHA512
44212fe2dc1979a8c7e266e30bddfb37771ddde9a78ab50da80465edaa7ec2e599150e87242209830a1a3c90a06a23942648859118b4dacd3673a526f5c33f8e
-
SSDEEP
6144:biyQAV1SKSynler6W2KgVQ408Rm4YvostRMeOyqZe3tr8VffR0wAPuedfiiBdEu1:OTAHpyr8IJmeTdEu75rT1YwWQERkfff
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-