General
-
Target
Delivery Note for Shipment.exe
-
Size
492KB
-
Sample
211021-g8cavshhg7
-
MD5
5ded4d74f7761520b4a596c10ea0496a
-
SHA1
ba488a543916b5571919c6fc350aa5cb0cf1e216
-
SHA256
cf81dcc1fa4f341c9cbbee1abbd1b5a508892b580139db90d857cb30cfdd2b98
-
SHA512
15765f7f11355937ee7f783e8591d35dfd9605fee5117da892db92de4d64e891d61b780787033aae1168be3537820a9a58cdbc8c2ef839415a898c800c6d9fd8
Static task
static1
Behavioral task
behavioral1
Sample
Delivery Note for Shipment.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Delivery Note for Shipment.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.prinutrition.com - Port:
587 - Username:
forrest@prinutrition.com - Password:
forrest
Targets
-
-
Target
Delivery Note for Shipment.exe
-
Size
492KB
-
MD5
5ded4d74f7761520b4a596c10ea0496a
-
SHA1
ba488a543916b5571919c6fc350aa5cb0cf1e216
-
SHA256
cf81dcc1fa4f341c9cbbee1abbd1b5a508892b580139db90d857cb30cfdd2b98
-
SHA512
15765f7f11355937ee7f783e8591d35dfd9605fee5117da892db92de4d64e891d61b780787033aae1168be3537820a9a58cdbc8c2ef839415a898c800c6d9fd8
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-