General
-
Target
414ac3b426347d733d3b317ed2c79ad1ffef30586618ef6c405a2bb9f8ecb46b
-
Size
600KB
-
Sample
220521-ayj5dsbaa9
-
MD5
68aa8f0e1a172c1067b9162d52fd5ff5
-
SHA1
045105280ef688f314b60fb33d784cbbd2480af4
-
SHA256
414ac3b426347d733d3b317ed2c79ad1ffef30586618ef6c405a2bb9f8ecb46b
-
SHA512
27797261b728fde3072bbc2822392e2b3071b3e9b54a437271fe8a21a41f7ea0566997fd0a54b4edab5518f4c4cfc07b05fef217fa2caaa960e40858b19d5f35
Static task
static1
Behavioral task
behavioral1
Sample
DHL_AWB_INV_9882900_99862788_998.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DHL_AWB_INV_9882900_99862788_998.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.tpts4seed.net - Port:
587 - Username:
[email protected] - Password:
Krested123@
Targets
-
-
Target
DHL_AWB_INV_9882900_99862788_998.exe
-
Size
547KB
-
MD5
0b5b259d171212bb43dd2097ef69642d
-
SHA1
0dfdeaee67585c6954d41e43d11ff9b965f16e7a
-
SHA256
4db8e3d8e29d6518086087c14ade8e22040bb81d6298f1eb23b893e7581eeb5c
-
SHA512
9b8edf063ded9e56caa032eff599448eea82a9781abf2c6ae096ad23bfda2666ffe713813b378b82a4bfc000f42bb750e1dcc587e29f58563fc8f6d670001323
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-