General
-
Target
80d87e4eed8e3bc297b535a44c7d4e5084309d7fb818548c90cba8364211c668
-
Size
485KB
-
Sample
220521-ajqnmaach6
-
MD5
cbc8f4e622f21c6be512e39a983b3b2c
-
SHA1
1bac3b2370a0e733d54a72219524a12ef11b2bc4
-
SHA256
80d87e4eed8e3bc297b535a44c7d4e5084309d7fb818548c90cba8364211c668
-
SHA512
3c0813ac244c6dd2e777ae3bd0b3fb16a79d7813d217e486ed4b0609ca4c723edcbb43310817b65543e323d96ccf7519ff18ca2ffd45eae3f0dc72bdd863794b
Static task
static1
Behavioral task
behavioral1
Sample
DHL EXPRESS -COMMERCIAL INVOICE, BILL OF LADING.pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DHL EXPRESS -COMMERCIAL INVOICE, BILL OF LADING.pdf.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
Loverboy123
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
Loverboy123
Targets
-
-
Target
DHL EXPRESS -COMMERCIAL INVOICE, BILL OF LADING.pdf.exe
-
Size
596KB
-
MD5
0145be441fee0c4e236e855ceb44d48c
-
SHA1
fd8451c5027ef05aeb9a76dc71cb959ac83eefd4
-
SHA256
d1b05a16a7f955432a7866f46ac2e32ed6ba21431e190d15fa46121f8ed2d46e
-
SHA512
29e6501d1e94453dd060c084457a92809a4143edf74af4b96e8017ef38f073e23b5a75eff060e2c7134ed3d23f38399a955e169afb664304efae3f0d7b1bdf22
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-