General
-
Target
DHL DOCUMENTS.exe
-
Size
747KB
-
Sample
211019-s9x5hahafq
-
MD5
d6e6a2b12de21b77970256e539a11b20
-
SHA1
bc2d1fd49e6c8f39be63e8f9aea10faee4fa9804
-
SHA256
9621554c8727d49421880fb2870af9ba1073cfc93340a3b67a9aafa4ccac401e
-
SHA512
5459cebf51e4603d4b3395c08a02c03b96a237e11f748c7b4116f16304413f41cee79a287089edab6150bf1cd00b666ca8dd1cf0a98c326bc25df0262904ac84
Static task
static1
Behavioral task
behavioral1
Sample
DHL DOCUMENTS.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
DHL DOCUMENTS.exe
Resource
win10-en-20210920
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.totallyanonymous.com/ - Port:
21 - Username:
[email protected] - Password:
613t705Z
Targets
-
-
Target
DHL DOCUMENTS.exe
-
Size
747KB
-
MD5
d6e6a2b12de21b77970256e539a11b20
-
SHA1
bc2d1fd49e6c8f39be63e8f9aea10faee4fa9804
-
SHA256
9621554c8727d49421880fb2870af9ba1073cfc93340a3b67a9aafa4ccac401e
-
SHA512
5459cebf51e4603d4b3395c08a02c03b96a237e11f748c7b4116f16304413f41cee79a287089edab6150bf1cd00b666ca8dd1cf0a98c326bc25df0262904ac84
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-