General
-
Target
Revised Order.exe
-
Size
700KB
-
Sample
211019-dklmvafbd6
-
MD5
e9901eec1af843e9546a659866270f6e
-
SHA1
57b6cccf4084b0a4aff6d236eb6a30df4fe8029f
-
SHA256
20307784e2521eb5d902498d8c893d7c884e518c38d8659780019ad08fbd341b
-
SHA512
b98b4937c9c94ebbe91f14e758a7b43d7999047c30840ca802ae60ec18fad4479c9bc21a1a375280119969ebc229065a85f17052804aff96b1246dbacd21959e
Static task
static1
Behavioral task
behavioral1
Sample
Revised Order.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Revised Order.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.aldhiyafainteriors.com - Port:
587 - Username:
[email protected] - Password:
dhiyafa@987
Targets
-
-
Target
Revised Order.exe
-
Size
700KB
-
MD5
e9901eec1af843e9546a659866270f6e
-
SHA1
57b6cccf4084b0a4aff6d236eb6a30df4fe8029f
-
SHA256
20307784e2521eb5d902498d8c893d7c884e518c38d8659780019ad08fbd341b
-
SHA512
b98b4937c9c94ebbe91f14e758a7b43d7999047c30840ca802ae60ec18fad4479c9bc21a1a375280119969ebc229065a85f17052804aff96b1246dbacd21959e
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-