General
-
Target
shipment.gz
-
Size
296KB
-
Sample
211022-3b4jqsdagn
-
MD5
e5dcc2573ee16a451cb03093b6bb8064
-
SHA1
673e9adb151b60de389b83950b6af349d0018711
-
SHA256
360ea572635b827ec4657dfc25b58f70359a418f0af9d0ea50dfd72bf15dc1b4
-
SHA512
628bcb93b3db0e66c9e5cc4b13c9345bd641ab62f9c3f763fadf9fe95f9dd7285e24702933eda76e4678e2831199d235285e9bf24ea9aa316fc778d6badfee3c
Static task
static1
Behavioral task
behavioral1
Sample
shipment.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
shipment.exe
Resource
win10-en-20210920
Malware Config
Targets
-
-
Target
shipment.exe
-
Size
368KB
-
MD5
12430c444bba13db2e0c95346148fbbe
-
SHA1
e5d6dc72a4788907013cfd6b6b4a1afdad2f4884
-
SHA256
ab0f36350855e4fc43815b6d4471bbbc2fce18b0275a9344eef58075c6a722fc
-
SHA512
786655abfe3a6ca412b8731e56ff7f74be8b775c1b3707a32c22820a62ace3474ca0e1853c75b7eb2c390debb77b3abd021a69759e8f92054c53f26e0e8a1fee
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-