General
-
Target
Delivery Note for Shipment.zip
-
Size
431KB
-
Sample
211021-g8cavsagfm
-
MD5
958fe4de1a07bf7885a5ad124a921c87
-
SHA1
f56b0dfbf74522f113f668c59edd8257258dea59
-
SHA256
1d5b1b0bb4782466a4fa285be8d5b5437a6e0321849bdf3436883d70d7419ae5
-
SHA512
2685f3c7b952dc486b5aea77ba0b54096a9cb000e3c385dbcb5775771e94d737fe11c8a51b46957d107586c518fc7a4adccbef263c16ddb43acf9074fd92a259
Static task
static1
Behavioral task
behavioral1
Sample
Delivery Note for Shipment.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Delivery Note for Shipment.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.prinutrition.com - Port:
587 - Username:
forrest@prinutrition.com - Password:
forrest
Targets
-
-
Target
Delivery Note for Shipment.exe
-
Size
492KB
-
MD5
5ded4d74f7761520b4a596c10ea0496a
-
SHA1
ba488a543916b5571919c6fc350aa5cb0cf1e216
-
SHA256
cf81dcc1fa4f341c9cbbee1abbd1b5a508892b580139db90d857cb30cfdd2b98
-
SHA512
15765f7f11355937ee7f783e8591d35dfd9605fee5117da892db92de4d64e891d61b780787033aae1168be3537820a9a58cdbc8c2ef839415a898c800c6d9fd8
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-