General
-
Target
shipping document.exe
-
Size
903KB
-
Sample
210419-ltzkmhjfga
-
MD5
b2e8cb36e8ed07eeb5873988a10e629e
-
SHA1
4c27ed343a8991373edcab4856ee5455e060aa0d
-
SHA256
1591047265c7c48f80cfaae3ce6745bd132236aad0cd93515f384fd94e583502
-
SHA512
5c572770494269f70f00352c5d329fe757cd17f7cfebdc838675feec14ea2d7b2fe7d12fb5eb8a86836328666763ae4b4443a3c66b129c9e1da06ae84746328f
Static task
static1
Behavioral task
behavioral1
Sample
shipping document.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
shipping document.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.a-k.co.ir - Port:
587 - Username:
[email protected] - Password:
09133434194
Targets
-
-
Target
shipping document.exe
-
Size
903KB
-
MD5
b2e8cb36e8ed07eeb5873988a10e629e
-
SHA1
4c27ed343a8991373edcab4856ee5455e060aa0d
-
SHA256
1591047265c7c48f80cfaae3ce6745bd132236aad0cd93515f384fd94e583502
-
SHA512
5c572770494269f70f00352c5d329fe757cd17f7cfebdc838675feec14ea2d7b2fe7d12fb5eb8a86836328666763ae4b4443a3c66b129c9e1da06ae84746328f
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-