General
-
Target
GHAI SHIPMENT SCHEDULE 28TH-07-2021.exe
-
Size
1.2MB
-
Sample
210728-6feqwzpvc2
-
MD5
e330461dfd3ff5099a0b05e06bc4bda9
-
SHA1
0faeb359703506fd0e0fa21ab3b23dda5ea868e6
-
SHA256
f85de586c3a33df88ebb5493c0bbcbd18c9f732e201c4c1604f2b2779976434e
-
SHA512
078bd784300123e45954db43d8d2ad941af2015856e533781303a60357f56d013cf9a3da1c023b38df81e0e186103bf98ed7f8edede42b35a6128e0b4a9381dc
Static task
static1
Behavioral task
behavioral1
Sample
GHAI SHIPMENT SCHEDULE 28TH-07-2021.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
GHAI SHIPMENT SCHEDULE 28TH-07-2021.exe
Resource
win10v20210408
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.themainreport.co.nz - Port:
587 - Username:
[email protected] - Password:
-I;MGhTyL{AQ
Targets
-
-
Target
GHAI SHIPMENT SCHEDULE 28TH-07-2021.exe
-
Size
1.2MB
-
MD5
e330461dfd3ff5099a0b05e06bc4bda9
-
SHA1
0faeb359703506fd0e0fa21ab3b23dda5ea868e6
-
SHA256
f85de586c3a33df88ebb5493c0bbcbd18c9f732e201c4c1604f2b2779976434e
-
SHA512
078bd784300123e45954db43d8d2ad941af2015856e533781303a60357f56d013cf9a3da1c023b38df81e0e186103bf98ed7f8edede42b35a6128e0b4a9381dc
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-