General
-
Target
Revised Order.zip
-
Size
551KB
-
Sample
211019-k7xrysfea9
-
MD5
919950e43442dea67e81b69bd23923eb
-
SHA1
3ef2a58930e7f79fa3764e396c2fd9e15f97bec3
-
SHA256
fbf3874618c8de5a447f5d757b707e6680e83dd6a2edf4a11dcf566de65064e9
-
SHA512
d53498c658aec417c65d5deb7f90cd02ea18c5bc3e710702152a83a727a0b9eb231dc5c923ac1ad9dd1ead849f20c4650349e0b3d0d8ad8a3b370553b5c91b89
Static task
static1
Behavioral task
behavioral1
Sample
Revised Order.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Revised Order.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.aldhiyafainteriors.com - Port:
587 - Username:
[email protected] - Password:
dhiyafa@987
Targets
-
-
Target
Revised Order.exe
-
Size
700KB
-
MD5
e9901eec1af843e9546a659866270f6e
-
SHA1
57b6cccf4084b0a4aff6d236eb6a30df4fe8029f
-
SHA256
20307784e2521eb5d902498d8c893d7c884e518c38d8659780019ad08fbd341b
-
SHA512
b98b4937c9c94ebbe91f14e758a7b43d7999047c30840ca802ae60ec18fad4479c9bc21a1a375280119969ebc229065a85f17052804aff96b1246dbacd21959e
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-