General
-
Target
Amended Purchhase Order_1.zip
-
Size
651KB
-
Sample
240329-rkqhpaah75
-
MD5
07c2858c132e612ba37e4986b0a66e7a
-
SHA1
0ecbbe80e975b405a29ce65745c9a7b68b8b38cb
-
SHA256
488bf5021933ae538ec23184735b36f74656861d1f124debf1023287b4d89c42
-
SHA512
646496642b1ab84d42ff514bb128c91273888061b0207424ed0dfaf0cdb8e0409583ff13e0604c9538b9721c6c0c11dddfaa20bebd681f80a6691c549b4b1162
-
SSDEEP
12288:3+NCLT7bpFlXEFhR710pQIDsmmag2yn7uvprvDO4724YCLx/3dvOVcYK:uNCvp0pZOQKsJfn7uRv/724D/dvOVcZ
Static task
static1
Behavioral task
behavioral1
Sample
oBMlky3Rkm7h5QK.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
oBMlky3Rkm7h5QK.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.pacificindia.com - Port:
587 - Username:
[email protected] - Password:
FEYEjBLgGnyw - Email To:
[email protected]
Targets
-
-
Target
oBMlky3Rkm7h5QK.exe
-
Size
744KB
-
MD5
596365c750c4f8e60a966e220e35e7d9
-
SHA1
234b7114f19589e1768670361e2a4cd7328f8c75
-
SHA256
e77c8ca31128a1a181b99a8234f39559854855d871d7abe167e004bb970e7f3c
-
SHA512
5679cc3bca181e417de60f4f8c473a17445405eb32f0e37855111ba5f6b8a95cc22225628da8c0227078177342ad3f9a1b9c3b985e04aff086d0a7e626e20047
-
SSDEEP
12288:akz4ayww0uLdzCeXEdFGpQCDsmIag2Sh7unpPcmg5I0i4DVlupWXAhT:UajazCe0dFoQQs55h7uVoG0dDVlup+
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-