General
- Target ORDERCENCY.exe
- Size 1.6MB
- Sample201109-95vmzyf24a
- SHA256 852ba24a7dc692c599e6ebf84b85c07b63033beba0067b4be7911f7e97bc40e6
- MD5 87ea5dd7ce0fa99533966a9f60ceba2d
- SHA1 13c387aed93d59ae9a317ff7c742867e2ef612a0
- SHA512 d9b49181313bd653bf8e6ca713ff120f4f542d98b455b697def6f658237b415050b5adef4a2aee63c4fd1bdc1f2bef143f86bb10c7f86497b33834eb51067c19
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
ORDERCENCY.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ORDERCENCY.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.safedepositvaults.com
-
Port
587
-
Username
-
Password
Safe@Deposit123
Targets
-
- Target ORDERCENCY.exe
- Size 1.6MB
- SHA256 852ba24a7dc692c599e6ebf84b85c07b63033beba0067b4be7911f7e97bc40e6
- MD5 87ea5dd7ce0fa99533966a9f60ceba2d
- SHA1 13c387aed93d59ae9a317ff7c742867e2ef612a0
- SHA512 d9b49181313bd653bf8e6ca713ff120f4f542d98b455b697def6f658237b415050b5adef4a2aee63c4fd1bdc1f2bef143f86bb10c7f86497b33834eb51067c19
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Deletes itself
-
Suspicious use of SetThreadContext