General
-
Target
ORDER.exe
-
Size
592KB
-
Sample
230328-hysersbc7x
-
MD5
7894e9970e32d04a35c1930e48e5afda
-
SHA1
6b06ac325aed4b6038e1a95cbac18941a5d71f43
-
SHA256
c150db08e8b3f241cb1ea3a82a15af0ed3a86f15f2e12f544f0731c8785a0405
-
SHA512
44212fe2dc1979a8c7e266e30bddfb37771ddde9a78ab50da80465edaa7ec2e599150e87242209830a1a3c90a06a23942648859118b4dacd3673a526f5c33f8e
-
SSDEEP
6144:biyQAV1SKSynler6W2KgVQ408Rm4YvostRMeOyqZe3tr8VffR0wAPuedfiiBdEu1:OTAHpyr8IJmeTdEu75rT1YwWQERkfff
Static task
static1
Behavioral task
behavioral1
Sample
ORDER.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ORDER.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.southernboilers.org - Port:
587 - Username:
info@southernboilers.org - Password:
Sksmoke2018# - Email To:
obtxxxtf@gmail.com
Targets
-
-
Target
ORDER.exe
-
Size
592KB
-
MD5
7894e9970e32d04a35c1930e48e5afda
-
SHA1
6b06ac325aed4b6038e1a95cbac18941a5d71f43
-
SHA256
c150db08e8b3f241cb1ea3a82a15af0ed3a86f15f2e12f544f0731c8785a0405
-
SHA512
44212fe2dc1979a8c7e266e30bddfb37771ddde9a78ab50da80465edaa7ec2e599150e87242209830a1a3c90a06a23942648859118b4dacd3673a526f5c33f8e
-
SSDEEP
6144:biyQAV1SKSynler6W2KgVQ408Rm4YvostRMeOyqZe3tr8VffR0wAPuedfiiBdEu1:OTAHpyr8IJmeTdEu75rT1YwWQERkfff
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-