General
- Target Purchase Orders.exe
- Size 726KB
- Sample230430-thb9dsab99
- SHA256 5dc9cbf0d5c02ac2e00ca8b14cf3a1965372ffad4618c806cf31fb7887aa08d2
- MD5 cbc29fa8f68311bc63fc62d7cb53db86
- SHA1 7ffd3f3aa7aed7d0ba8c9ec2a6a79b08c9db33f0
- SHA512 d8065790b5c756aa34f83836bcdd537df768b0ae5ab99324cbf74604157553697158bfe0db81243dbacb98c0544bf1233610785d493656c7d6e0cec5199a2f72
- SSDEEP 12288:uL1+cpMLL4hqgBxyrN4JxATOQuOC1gtmzC5JdvkQ5IQOBHfEolVlcVOh:QRVBkrNKxYOQygtmzWkQ2QMHsolVlcy
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Purchase Orders.exe
Resource
win7-20230220-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Purchase Orders.exe
Resource
win10v2004-20230220-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.modelinfra.com
-
Port
587
-
Username
-
Password
Mic@dmin*&^123
-
Email to
Targets
-
- Target Purchase Orders.exe
- Size 726KB
- SHA256 5dc9cbf0d5c02ac2e00ca8b14cf3a1965372ffad4618c806cf31fb7887aa08d2
- MD5 cbc29fa8f68311bc63fc62d7cb53db86
- SHA1 7ffd3f3aa7aed7d0ba8c9ec2a6a79b08c9db33f0
- SHA512 d8065790b5c756aa34f83836bcdd537df768b0ae5ab99324cbf74604157553697158bfe0db81243dbacb98c0544bf1233610785d493656c7d6e0cec5199a2f72
- SSDEEP 12288:uL1+cpMLL4hqgBxyrN4JxATOQuOC1gtmzC5JdvkQ5IQOBHfEolVlcVOh:QRVBkrNKxYOQygtmzWkQ2QMHsolVlcy
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext