General
-
Target
LM Approved Invoice-04-05-2021.doc
-
Size
3.8MB
-
Sample
210504-vqzj4jny92
-
MD5
95f8e935279c289154b784d37bfdbae7
-
SHA1
3e711dc23a09ef291f95b7e06c9ba708e35dbe95
-
SHA256
4caa64908b36893b18dca45402ee03d15381c605b6c0f07497f209f73a1c038d
-
SHA512
cb7d9d0849087f0800fb1dec9185debe1b3baae0244ac62e32adcf49e2058df29514b801b2802a35c4acc33c2d142a84ebbc27f91e8f95f104d4a519b8efc5bb
Static task
static1
Behavioral task
behavioral1
Sample
LM Approved Invoice-04-05-2021.doc
Resource
win7v20210408
Behavioral task
behavioral2
Sample
LM Approved Invoice-04-05-2021.doc
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.nilkarnal.com - Port:
587 - Username:
logs@nilkarnal.com - Password:
company1960
Targets
-
-
Target
LM Approved Invoice-04-05-2021.doc
-
Size
3.8MB
-
MD5
95f8e935279c289154b784d37bfdbae7
-
SHA1
3e711dc23a09ef291f95b7e06c9ba708e35dbe95
-
SHA256
4caa64908b36893b18dca45402ee03d15381c605b6c0f07497f209f73a1c038d
-
SHA512
cb7d9d0849087f0800fb1dec9185debe1b3baae0244ac62e32adcf49e2058df29514b801b2802a35c4acc33c2d142a84ebbc27f91e8f95f104d4a519b8efc5bb
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-