General
- Target QT21136583_Order_Doc.exe
- Size 341KB
- Sample211014-khkq4aggc9
- SHA256 ccc78c1d61ff6eb4b314c9ffbbd9f172984a6b3decb088b1398a96b382a3149e
- MD5 ac0f49a715ebc7eb6e51fb986425136e
- SHA1 813346ea143739c3fede3cde1d612de75ab731bf
- SHA512 630f8a9c7da1dd996af1e96d9d83c5fd025f102b9e7835fbaf2815e676aba6b7aacf4ce1e880be4b5f13ffaf07d914145f71b08d70a1f085fd95c68e5c274360
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
QT21136583_Order_Doc.exe
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
QT21136583_Order_Doc.exe
Resource
win10v20210408
0 signatures
0 seconds
Malware Config
Targets
-
- Target QT21136583_Order_Doc.exe
- Size 341KB
- SHA256 ccc78c1d61ff6eb4b314c9ffbbd9f172984a6b3decb088b1398a96b382a3149e
- MD5 ac0f49a715ebc7eb6e51fb986425136e
- SHA1 813346ea143739c3fede3cde1d612de75ab731bf
- SHA512 630f8a9c7da1dd996af1e96d9d83c5fd025f102b9e7835fbaf2815e676aba6b7aacf4ce1e880be4b5f13ffaf07d914145f71b08d70a1f085fd95c68e5c274360
- MD5 SHA1 SHA512
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext