General
-
Target
SHIPPING_PLANS_CHANGES_NOTIFICATION.vbs
-
Size
33KB
-
Sample
211202-gs66asfah8
-
MD5
e450f3ffcc08c150f076efde51ab67a1
-
SHA1
3c5beebf6682be18632ac9ff9f84ce84803359b5
-
SHA256
52aa8695c6ab60ec79e5f7fdd1fea7685180e0f99f62be26912655b6f46627ef
-
SHA512
dcac4f9015f7c240e28e65aab7bc71f3c83a19d3a1cb5794c6b02210738a863dd6ae5c8023c6d35d35994ff3d1f2ba28c73641b28ebed3b2c3b4437b1a3d1887
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING_PLANS_CHANGES_NOTIFICATION.vbs
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
SHIPPING_PLANS_CHANGES_NOTIFICATION.vbs
Resource
win10-en-20211104
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot2121726525:AAFrqm4Wr9ZjKe10NHMlMz_4y4K5MTixoBk/sendDocument
Targets
-
-
Target
SHIPPING_PLANS_CHANGES_NOTIFICATION.vbs
-
Size
33KB
-
MD5
e450f3ffcc08c150f076efde51ab67a1
-
SHA1
3c5beebf6682be18632ac9ff9f84ce84803359b5
-
SHA256
52aa8695c6ab60ec79e5f7fdd1fea7685180e0f99f62be26912655b6f46627ef
-
SHA512
dcac4f9015f7c240e28e65aab7bc71f3c83a19d3a1cb5794c6b02210738a863dd6ae5c8023c6d35d35994ff3d1f2ba28c73641b28ebed3b2c3b4437b1a3d1887
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Blocklisted process makes network request
-
Drops startup file
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-