General
-
Target
olii.exe
-
Size
270KB
-
Sample
211021-rbjzjsbcdk
-
MD5
ba9d3f63058ea4041190e82e03ffd5f6
-
SHA1
2bd055abacc3b9ad6f7cb1fa8613c7c44fd21943
-
SHA256
bfb35a39b72e24ce801468a629e64b1806ae5cf8339ade1ee7f145ec4497be93
-
SHA512
7e2d37dd5921cda5ebff477308644b1a7f1b2586e6792f17d6f59b911dc04ed91db2569032dd9d5f3fa29e9caefb906153336052c256297354cfe73fc58b5462
Static task
static1
Behavioral task
behavioral1
Sample
olii.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
olii.exe
Resource
win10-en-20210920
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot2046248941:AAG5Z0PyWwtApmPaysBm59voK10ec9Rgnaw/sendDocument
Targets
-
-
Target
olii.exe
-
Size
270KB
-
MD5
ba9d3f63058ea4041190e82e03ffd5f6
-
SHA1
2bd055abacc3b9ad6f7cb1fa8613c7c44fd21943
-
SHA256
bfb35a39b72e24ce801468a629e64b1806ae5cf8339ade1ee7f145ec4497be93
-
SHA512
7e2d37dd5921cda5ebff477308644b1a7f1b2586e6792f17d6f59b911dc04ed91db2569032dd9d5f3fa29e9caefb906153336052c256297354cfe73fc58b5462
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-