General
- Target DHL EXPRESS 564564645.exe
- Size 1.3MB
- Sample201109-yvvkrcxpfa
- SHA256 fb3010b0874dffd1d587f2a8a1b73eb444085f853070f71dbf0012a5fa7fcdf0
- MD5 297e85986df880bdacc7a65f33ef8057
- SHA1 2659d60c218d6d407b6a9d0a6b36649ea50098c5
- SHA512 d353f6ef56fb0c139a916439c64fe8805b19ea857304edd139dc5b8ccff2179b16d8fd68e30371defb9894ff592f2040b4f7279ddda07f88af1b6739d441d357
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
DHL EXPRESS 564564645.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DHL EXPRESS 564564645.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.erkonsentre.com
-
Port
587
-
Username
-
Password
PNqkQSU8
Extracted
Credentials
-
Protocol
smtp
-
Host
smtp.erkonsentre.com
-
Port
587
-
Username
-
Password
PNqkQSU8
Targets
-
- Target DHL EXPRESS 564564645.exe
- Size 1.3MB
- SHA256 fb3010b0874dffd1d587f2a8a1b73eb444085f853070f71dbf0012a5fa7fcdf0
- MD5 297e85986df880bdacc7a65f33ef8057
- SHA1 2659d60c218d6d407b6a9d0a6b36649ea50098c5
- SHA512 d353f6ef56fb0c139a916439c64fe8805b19ea857304edd139dc5b8ccff2179b16d8fd68e30371defb9894ff592f2040b4f7279ddda07f88af1b6739d441d357
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext