General
-
Target
da985a872b159c933ec33a26d541c50716d1432a32af9ce870e5fd2eccbee1fe
-
Size
619KB
-
Sample
231206-djgbqsae79
-
MD5
b6b3a975ed3670db9e7b1f077aa2ead6
-
SHA1
5dcde20455a135c566bea389c973ad3253417d09
-
SHA256
da985a872b159c933ec33a26d541c50716d1432a32af9ce870e5fd2eccbee1fe
-
SHA512
94b890dbcc516f21ea54e2a0c4413c6939a1bdeb794076333cc0ff922346d05744e3f0897a2f955afc81014e406ac80dc38b2da890540c0e7fbced44e8c0488b
-
SSDEEP
12288:vDVBqs2iKjFRYMIAqFziyltrIMRCsiad87P7VwqbWD1ktqcYngSsfq2wq:vDas1oFRDqFziKIYi7P7VzBtqcY588q
Static task
static1
Behavioral task
behavioral1
Sample
Order.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Order.exe
Resource
win10v2004-20231201-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
kV$bSqJ1 daniel - Email To:
[email protected]
Targets
-
-
Target
Order.exe
-
Size
728KB
-
MD5
1babf99cab6b7acb1dc816eaa5873fb0
-
SHA1
0f014d8b30ae7b40214033731b82939a649873bc
-
SHA256
26794f7598febe976fb23ad9abe87ca823f65730957ce7821ce5bc9e6dbfab92
-
SHA512
9803f94af1db4dd79e572e97adb788e309b134f5de485eff800e926e4a5f2baf1d48404b19b993c0b959252176660a93ab6ee65b7f18e9a8a21cb3cae36b49ab
-
SSDEEP
12288:iCKE6jD/62iNG5nF8R9iSlBrIORCsSad87XTVKqlWDtk7qcqn0bkSYAVSt:iCKtD/61I0i6cKi7XTVRh7qcq0bFY8
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-