General
-
Target
MV OCEAN DRAGON - SHIP PARTICULARS & OCEAN-DRAGON - STOWAGE PLAN.pdf.cab
-
Size
292KB
-
Sample
211022-kn6whsbdc6
-
MD5
cdec9a14981d87189e36b157d3323b71
-
SHA1
8c0eb91cf8cfb0aefd349cbb07a7d9eb38d528ed
-
SHA256
bc2d9173bd88aa9a5004f6e96e23cb0bc7f7f4ca2e5ae7faaf0bec218e74ce34
-
SHA512
b3b07f3149c384701306150211a609dda0c4a274a9e57174c15d67a24d66f5d58f074e5915d70fc3bf0b4f6d6374e7da877b261c93c3b478fddcdfcd444e5158
Static task
static1
Behavioral task
behavioral1
Sample
MV OCEAN DRAGON - SHIP PARTICULARS & OCEAN DRAGON - STOWAGE PLAN.pdf.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
MV OCEAN DRAGON - SHIP PARTICULARS & OCEAN DRAGON - STOWAGE PLAN.pdf.exe
Resource
win10-en-20210920
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.penavico--cz.com - Port:
587 - Username:
ops@penavico--cz.com - Password:
Fq$L%J((!6
Targets
-
-
Target
MV OCEAN DRAGON - SHIP PARTICULARS & OCEAN DRAGON - STOWAGE PLAN.pdf.exe
-
Size
482KB
-
MD5
43d51713fd393de6a97793c342d51b9b
-
SHA1
483cda88bfea3555de80f01d72aa4d52c4c6bdcf
-
SHA256
791c27879e42834fdb2537f9e0be908112a74429f7a3b7ac62e8735a3b764951
-
SHA512
c5d5e86d074caf9a440cabddc6bc5f839b35c0fad62ce8dc382d43d96f9208cbcc7a94b918bb6c314606ff3fe286575a611460401f4367f9c3f3cdd3b1491d32
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-