General
-
Target
new order 00041221.exe
-
Size
729KB
-
Sample
210727-gtsax44rxe
-
MD5
ffe30c4ac40f0e43147b0ffe6ede3e3f
-
SHA1
bde322fd8135752b32f0301887e25295a08f2b44
-
SHA256
9f34067bfd42e0ddfff753c0e045a4a1df331d738ec6946ed35531f8cf33440b
-
SHA512
1e70a0a0fb23c88f49fc702127e4d826454d4406ebee05d07ef341283c57fb1e12094ce3c4fa54e328771366dadc0935bf15d20a0d585783c0afe0002c1d7b2c
Static task
static1
Behavioral task
behavioral1
Sample
new order 00041221.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
new order 00041221.exe
Resource
win10v20210408
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.marcer.com.tr - Port:
587 - Username:
muhasebe@marcer.com.tr - Password:
mar1453
Targets
-
-
Target
new order 00041221.exe
-
Size
729KB
-
MD5
ffe30c4ac40f0e43147b0ffe6ede3e3f
-
SHA1
bde322fd8135752b32f0301887e25295a08f2b44
-
SHA256
9f34067bfd42e0ddfff753c0e045a4a1df331d738ec6946ed35531f8cf33440b
-
SHA512
1e70a0a0fb23c88f49fc702127e4d826454d4406ebee05d07ef341283c57fb1e12094ce3c4fa54e328771366dadc0935bf15d20a0d585783c0afe0002c1d7b2c
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-