General
-
Target
14d0cdba68912adb7e3e41ec153b54a7_JaffaCakes118
-
Size
1.2MB
-
Sample
240329-bmcrlsec23
-
MD5
14d0cdba68912adb7e3e41ec153b54a7
-
SHA1
49e7de2e491f083a57e95242c30dcec81387b5d2
-
SHA256
29b62913dff22b807aff95724c4803a015cfbce80f870f64d16757caf12dd9b1
-
SHA512
f9d9563322a53cf969b2bf309438d842c154e0c3450c3ff27eab9c69086750fa280730c47a842093f91787ba46322b0cab496c7d194a5449147ce1e541416588
-
SSDEEP
12288:PhvUUWYU6PqKnGR3nEWlf0nRHqnlqw3h/MtLyb0:5MUWYU753ZgBYqwR/Mpyb
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PURCHASE ORDER.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
e)cnIdR1
Targets
-
-
Target
PURCHASE ORDER.exe
-
Size
607KB
-
MD5
07235191bc4a2cb3bd75667ddaf43950
-
SHA1
2068b25e2b28889e26395be0c401b6f8c7838cd0
-
SHA256
0e3e6413a4c2f3666b7ffa43b3b1b13f470875f410a13c0ec6bbd2ddae3bd8cf
-
SHA512
ffaa3651b51301faa0c782ad80470ba99e80db154a19cdfae4965bb5705896a1109511337c0508898381357731f6cf664026e6d40a8ba4e913259f2ce1bcd8e7
-
SSDEEP
12288:WhvUUWYU6PqKnGR3nEWlf0nRHqnlqw3h/MtLyb0:OMUWYU753ZgBYqwR/Mpyb
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-