General
-
Target
shipping document.zip
-
Size
697KB
-
Sample
210419-yka2ala2we
-
MD5
b3874d133db07b3e02bbaf6570aeb9ad
-
SHA1
f784091e40a76613d85762a73123ebd107568821
-
SHA256
3cd91536b366a2d0dd11691a47fbd169e8720d2a70ae7c7fcd3f89838b92de79
-
SHA512
e2756854fc2429b316df2203df77b5e77880f8fcf46a8d8a99567a1752cf726325fdb563bababf27236d8909eb31b19fa5d4ab472a27e8d57365864daa1cb8f5
Static task
static1
Behavioral task
behavioral1
Sample
shipping document.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
shipping document.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.a-k.co.ir - Port:
587 - Username:
[email protected] - Password:
09133434194
Targets
-
-
Target
shipping document.exe
-
Size
903KB
-
MD5
b2e8cb36e8ed07eeb5873988a10e629e
-
SHA1
4c27ed343a8991373edcab4856ee5455e060aa0d
-
SHA256
1591047265c7c48f80cfaae3ce6745bd132236aad0cd93515f384fd94e583502
-
SHA512
5c572770494269f70f00352c5d329fe757cd17f7cfebdc838675feec14ea2d7b2fe7d12fb5eb8a86836328666763ae4b4443a3c66b129c9e1da06ae84746328f
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-