General
-
Target
142bc170a3d4f0f08ef8a77eacd94766_JaffaCakes118
-
Size
535KB
-
Sample
240329-a35xnach7w
-
MD5
142bc170a3d4f0f08ef8a77eacd94766
-
SHA1
687012c964f744f6bf83626bc1d2e372820b6207
-
SHA256
551c222081882fcb8968d315fd1c74b57572404d9f1a0d15767c4a2ed9ca348e
-
SHA512
948d61780193ee63663747df37b57c9cc515a6f3d5aef3275691bdcd9299b3cd1db7d5a3946ad83d98a7ee06644fcc29597f6806989ddf0bf2dfad32077ff392
-
SSDEEP
12288:b8EU4EsSEEU4uwIEFO+K/UpvrSNZF4LXjj8c21DvcApFb+IRi:b8z7U4rIEFNdTS/FqXkbvbFbrc
Static task
static1
Behavioral task
behavioral1
Sample
Purchase order.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Purchase order.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
sg2plcpnl0023.prod.sin2.secureserver.net - Port:
587 - Username:
nbsupports@seshsupports.com - Password:
User@40378
Targets
-
-
Target
Purchase order.exe
-
Size
627KB
-
MD5
1363b11e2105d3486b2b5e8479c57a12
-
SHA1
b9d24a83153aa0af8b1d00214096ddc75d0464e1
-
SHA256
1a2283bb101bc94c20d48d0ad06f11ce6cb7d0ad76e117a4176b71900dd4c6b3
-
SHA512
ac431b6933b6b46e73e958efed679986df80b8b867536908375b36bef259e4521b6488dea91c30ceb1cfd92b0c26a1f5d044ea4d824eff2eaa3280191575765b
-
SSDEEP
12288:6mVMrkaDkW1wpB8faLg2z05c2/3y4hYcCowre+fOPXBDcexQzNkSBx4:WjoWSP/LVy/i4h1hMZfYXB4BzN5Bx4
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-