General
-
Target
SOA.zip
-
Size
386KB
-
Sample
211203-vxa6bahbaj
-
MD5
64883af972270068cf0e6c41eca8fb67
-
SHA1
d9e927add4438330a56aa947e28f11cd0025686e
-
SHA256
edf6fdb4c975d7723792e940acf4da59fdab4c59baf45f961a9e5482bbabb1d1
-
SHA512
1c7613ca64f4bdde1c290d6345242576c0614b8c14c7aec653d64430c885e67453fd24279a596c278bb35aa003d66cf7b013cb5e17b5b1c20318bc181d87445f
Static task
static1
Behavioral task
behavioral1
Sample
SOA.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
SOA.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.dieseltronic.com.pe - Port:
587 - Username:
[email protected] - Password:
Asdiesel2019@?%%%,
Targets
-
-
Target
SOA.exe
-
Size
463KB
-
MD5
563ace61f357fe73207c546cbec9c0cd
-
SHA1
6cc9bbe6704f4a54105502672d246e97d3c9688e
-
SHA256
9beb57914c705bfd2a1bfaca1bd2f4beca2a2cd8dff49229558bca04774a360a
-
SHA512
a48b165149fdd63b2ea95bafec0b4a22ca615530dabcb206a584d38d8cc3d7f4d1da3b64dc6096eaa4507d9bc98f115930384258873513b64b856b94d6934cda
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-