General
-
Target
New Order.pdf.z
-
Size
288KB
-
Sample
230613-hkw6ssfc28
-
MD5
89689dc72ee93b6047f83c14adfe3908
-
SHA1
a1360d85acf7e4a281b32daf3a656fc3be12372b
-
SHA256
4f92ad986f76bd24284b367ac88db0e63437ebd35559e4942b1ee1c35a7ef5d7
-
SHA512
a7126554695b54c9c6739ac066aa81cb6e13a5d2320d537df2067f813dcc538f22d7a4e0d5c7d78e1214a4c1344fe8a81294de61a42e060326c734b422c70441
-
SSDEEP
6144:2d14bEWhA5/ZgH8QWcrQPhIuF0HR8iV0oanece9Vq:2d14s/qH8QWcrQPOZHR8iVTseLvq
Static task
static1
Behavioral task
behavioral1
Sample
New Order.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
New Order.exe
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
New Order.exe
-
Size
330KB
-
MD5
af91bd1a0af069b39b3293dcd50bd4fa
-
SHA1
9ff4d3d6a7f355d9114dfccd620c614ab4b2632e
-
SHA256
97ad8dbd6e1db83248c8ca803510f18477375e1b5ef37d7cf2811ff565346c09
-
SHA512
ca7289f92b3f0c1865eb3c537ef1580860c59af744656461c7d22487be0500ecbd75b93c29ecf82ffd4eae3e1556759db1562f7260944ddbeb1931224f5ea734
-
SSDEEP
6144:wYa6RQq1CWmEkBpbf5VNuFOuvsWn4LVpikZ4jKyxza0Q8QvNn:wY3rADN4b5nWLKjR9W9
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-