General
-
Target
RF_DHL KULI500796821_PO200000035_SCAN DOCS.exe
-
Size
450KB
-
Sample
200710-e5d86662n6
-
MD5
8f178a002181e9b40cd09e244b61d1c9
-
SHA1
ea47dfa2d70ee217a9a5c4cf19c66c8a65108fc4
-
SHA256
bc3ad77264762f9b266ab641f391bbb456ef4bc5c27f64b884506eeaa84dfe58
-
SHA512
fa15075384a95e57c2077127fbccfc4eeed67d81cf140685c416858a7ca9bc5d310149d0952bf6fbdcfc0db65f7a53d1508edfadd490e69e1333137b5a327d15
Static task
static1
Behavioral task
behavioral1
Sample
RF_DHL KULI500796821_PO200000035_SCAN DOCS.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
RF_DHL KULI500796821_PO200000035_SCAN DOCS.exe
Resource
win10
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
faith12AB
Targets
-
-
Target
RF_DHL KULI500796821_PO200000035_SCAN DOCS.exe
-
Size
450KB
-
MD5
8f178a002181e9b40cd09e244b61d1c9
-
SHA1
ea47dfa2d70ee217a9a5c4cf19c66c8a65108fc4
-
SHA256
bc3ad77264762f9b266ab641f391bbb456ef4bc5c27f64b884506eeaa84dfe58
-
SHA512
fa15075384a95e57c2077127fbccfc4eeed67d81cf140685c416858a7ca9bc5d310149d0952bf6fbdcfc0db65f7a53d1508edfadd490e69e1333137b5a327d15
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-