General
-
Target
NUOVO_ORDINE.exe
-
Size
1006KB
-
Sample
210722-kx3kdhgt5x
-
MD5
2aafcce94fdbdab28bc6ea753696b34d
-
SHA1
21f6503ca90d2706a285481df4022eabfa1a8f5b
-
SHA256
6786461e40eb0f01aae080ffd69a58eee8d8997e7c4d6e20abed3f24119f5633
-
SHA512
1bf83b7590ca44f093d9d569c7431056162829ef34b3373c29b38d47cfd45cd4bd973c59fcf218608d8ab2e17df0ee6b96b8e6f3e26972458983bfc2ca051c70
Static task
static1
Behavioral task
behavioral1
Sample
NUOVO_ORDINE.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
NUOVO_ORDINE.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.kenner-tw.com - Port:
587 - Username:
[email protected] - Password:
IElbAu@Kj5
Targets
-
-
Target
NUOVO_ORDINE.exe
-
Size
1006KB
-
MD5
2aafcce94fdbdab28bc6ea753696b34d
-
SHA1
21f6503ca90d2706a285481df4022eabfa1a8f5b
-
SHA256
6786461e40eb0f01aae080ffd69a58eee8d8997e7c4d6e20abed3f24119f5633
-
SHA512
1bf83b7590ca44f093d9d569c7431056162829ef34b3373c29b38d47cfd45cd4bd973c59fcf218608d8ab2e17df0ee6b96b8e6f3e26972458983bfc2ca051c70
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-