General
-
Target
SALE ORDER.zip
-
Size
384KB
-
Sample
211203-vtepbshahm
-
MD5
810e15e75b501cba5840625334af534e
-
SHA1
3fd07c989bfc021a34a43fe74a4159236c1e87fb
-
SHA256
ce9b39a6296a41339678e75b6004ce70ddfd839a496a058e0eb025cfa0a1e833
-
SHA512
a28d41d2c87a8a4878ff69f885f39d37417b748d3f9edbfb846b1231334514eae0980279f63c8011cefd963c77b949446aa9a34ebe0454c2f5eb0ed45cf15741
Static task
static1
Behavioral task
behavioral1
Sample
SALE ORDER.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
SALE ORDER.exe
Resource
win10-en-20211104
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.dieseltronic.com.pe - Port:
587 - Username:
[email protected] - Password:
Asdiesel2019@?%%%,
Targets
-
-
Target
SALE ORDER.exe
-
Size
463KB
-
MD5
563ace61f357fe73207c546cbec9c0cd
-
SHA1
6cc9bbe6704f4a54105502672d246e97d3c9688e
-
SHA256
9beb57914c705bfd2a1bfaca1bd2f4beca2a2cd8dff49229558bca04774a360a
-
SHA512
a48b165149fdd63b2ea95bafec0b4a22ca615530dabcb206a584d38d8cc3d7f4d1da3b64dc6096eaa4507d9bc98f115930384258873513b64b856b94d6934cda
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-