General
- Target New Order _list.exe
- Size 301KB
- Sample230620-hlb71sae83
- SHA256 a2e2e1fa1e718c0d2505ef567dca7a115d9cf17e67c9aade481187874216bf3f
- MD5 b3579732c909136ef842302a1261b3cd
- SHA1 929e7e3617b3c9125e78bcf0609a609f43070e05
- SHA512 b24f836169d405dc479feaadfcdc8eaa900efbd09a0359a234b06e1b5ab88d23af7c7d4fe0d403e3210261c127dc43e303322d7e287025437142f8f3887b36f0
- SSDEEP 6144:/Ya67ChnwlfzjwVGpSLunMIAB/Nz3/C/0IpKDmQh1dOYes5J/OLbtjN:/YxCOlfzjwVZLFBVzalv0jOYZxOLb/
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
New Order _list.exe
Resource
win7-20230220-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
New Order _list.exe
Resource
win10v2004-20230220-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target New Order _list.exe
- Size 301KB
- SHA256 a2e2e1fa1e718c0d2505ef567dca7a115d9cf17e67c9aade481187874216bf3f
- MD5 b3579732c909136ef842302a1261b3cd
- SHA1 929e7e3617b3c9125e78bcf0609a609f43070e05
- SHA512 b24f836169d405dc479feaadfcdc8eaa900efbd09a0359a234b06e1b5ab88d23af7c7d4fe0d403e3210261c127dc43e303322d7e287025437142f8f3887b36f0
- SSDEEP 6144:/Ya67ChnwlfzjwVGpSLunMIAB/Nz3/C/0IpKDmQh1dOYes5J/OLbtjN:/YxCOlfzjwVZLFBVzalv0jOYZxOLb/
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext