General
-
Target
DHL Shipment Delivery Notification.exe
-
Size
660KB
-
Sample
210504-grgx121te2
-
MD5
b647a8fd6ee1bf9e5db31683f9eb54c9
-
SHA1
4171996b6299ac356f2dc6321398fdc40f6e43c4
-
SHA256
180688c5883698ccf8bb7114a6f5ba5f2433cbc6604ba785ddd102f2db89f9bd
-
SHA512
bcbeba94e718919139a79540c3f031622f83791e96173328a9572b63549b7d77edfbe386e9e92369361e5bd1d5b579f03ded60982419a3d2ed36b02fa5e9b1df
Static task
static1
Behavioral task
behavioral1
Sample
DHL Shipment Delivery Notification.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
DHL Shipment Delivery Notification.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
michael.boom@sportfiv.com - Password:
XKzOC$Y7
Targets
-
-
Target
DHL Shipment Delivery Notification.exe
-
Size
660KB
-
MD5
b647a8fd6ee1bf9e5db31683f9eb54c9
-
SHA1
4171996b6299ac356f2dc6321398fdc40f6e43c4
-
SHA256
180688c5883698ccf8bb7114a6f5ba5f2433cbc6604ba785ddd102f2db89f9bd
-
SHA512
bcbeba94e718919139a79540c3f031622f83791e96173328a9572b63549b7d77edfbe386e9e92369361e5bd1d5b579f03ded60982419a3d2ed36b02fa5e9b1df
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-