General
-
Target
6f13354929e61672b2489e06c12f5147136414f00ba5bc601910db4476b6db24
-
Size
462KB
-
Sample
220521-n2nhwahfcm
-
MD5
2b4ee2d35fd6636dcd08a3d9435dee2e
-
SHA1
5b33145f8bf9485b0cdc985d7f13f75ef4298467
-
SHA256
6f13354929e61672b2489e06c12f5147136414f00ba5bc601910db4476b6db24
-
SHA512
6b17ccd26d53d5e811081d93085aa88784b3a308a6998bd6fb110b7cb43094f3f3d9cd5b11d89890bc9953917064fd269c770a45cccee59f8130d88e52f14ef8
Static task
static1
Behavioral task
behavioral1
Sample
Order_list.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Order_list.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.tpcdel.com - Port:
587 - Username:
[email protected] - Password:
EmlP@2018
Extracted
Protocol: smtp- Host:
mail.tpcdel.com - Port:
587 - Username:
[email protected] - Password:
EmlP@2018
Targets
-
-
Target
Order_list.exe
-
Size
791KB
-
MD5
212a1fa6d47552cda426fa3c705fbe39
-
SHA1
813d5496d32e91af0f8145c050e5fb8e59374f0e
-
SHA256
a5098f19a742da9d5186552a2b5c56eb6aa8272406c8a723c613d7f7b2215afe
-
SHA512
b105f6570a77534b93032e32962866ed902aa8b45c4e9d692d267441d3cdd81c6975757b197aa142a78ebc1141ffdecd074b1c656af289e6d7c84af20608b5f1
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-