General
- Target Revised Order.exe
- Size 1.4MB
- Sample201109-3jf6e45vbx
- SHA256 56c86f76934005ff25803fc7b71dfbde700ebe9bec9fa69959c16672fd458e59
- MD5 c846a747027c16f452fb6322de6a20a4
- SHA1 00144a852c15d42bc09809f028308334750a828c
- SHA512 8e75407172275e2ea17d8653f3bece7ff6da0228f9e959a6014c0c86778ee7ba0b32554cb88de78a03cf56dfd59cf6c71556f2a2dc723d1b22408942e40107b5
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Revised Order.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Revised Order.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.poongln.com
-
Port
587
-
Username
-
Password
xfLnM!a7
Targets
-
- Target Revised Order.exe
- Size 1.4MB
- SHA256 56c86f76934005ff25803fc7b71dfbde700ebe9bec9fa69959c16672fd458e59
- MD5 c846a747027c16f452fb6322de6a20a4
- SHA1 00144a852c15d42bc09809f028308334750a828c
- SHA512 8e75407172275e2ea17d8653f3bece7ff6da0228f9e959a6014c0c86778ee7ba0b32554cb88de78a03cf56dfd59cf6c71556f2a2dc723d1b22408942e40107b5
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext