General
-
Target
2616604f408cc4d870f48fe9ad41b67c69aa29578ae1e9e659f8954270c3d1c1
-
Size
606KB
-
Sample
220520-2zz1sabcej
-
MD5
c256b254f38e20c7aa4b5fced9c9f0b4
-
SHA1
ccc858f80f4b1e366677398c79fe5b9d8c5dc02a
-
SHA256
2616604f408cc4d870f48fe9ad41b67c69aa29578ae1e9e659f8954270c3d1c1
-
SHA512
e64ed930883d6ddf02bb362b62fe5b9cec976581861a3f92747ba913668b22f3c077b2aca2058ab3fe1b986643844f2bca0157bea26d0d734dae7c92f11939bc
Static task
static1
Behavioral task
behavioral1
Sample
Receipt for shipment - Company Official-20200831_pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Receipt for shipment - Company Official-20200831_pdf.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1257859103:AAFTtbxtjom70byHvb91Gtjsug-omemEwwc/sendDocument
Targets
-
-
Target
Receipt for shipment - Company Official-20200831_pdf.exe
-
Size
553KB
-
MD5
1331ca8cfbbdb3832b7baf7ffc48ee19
-
SHA1
07f268f8a3443f542a0d620aece2c23a30f6451b
-
SHA256
dab8c3350d525d66785c80647dd39cac8fc981c7a18c66b8bea5526926c6aad6
-
SHA512
4144c25096905d13086acfbb8515f9dfce04015042864373850a51c51c4bffa86a5a10fb389223f7c2503b863f931a9a429d9a812a3ce152f5d7823fa915c831
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-