agenttesla | 1ea26893b98115c9c36c6c1ecb7b4fa28b71ea8dc91f7219c7e54d9f95d4bf8e

General

Target
1ea26893b98115c9c36c6c1ecb7b4fa28b71ea8dc91f7219c7e54d9f95d4bf8e
Size 809KB
Sample220521-dxdg1agdh8
SHA256 1ea26893b98115c9c36c6c1ecb7b4fa28b71ea8dc91f7219c7e54d9f95d4bf8e
MD5 cc5d1ba1b2cd9a126ce8cbc974e01f68
SHA1 f0819d43a4c6fab61ac49829a704db3e9193775f
SHA512 2b3220b2229f5cf20eb75c07c51cb3fb4bbaadebf7cb12507fc2c4fa0599833dc504146a0045565a8b7cb60793764f78d573a668c10faed350f1edc43b09bc58
SSDEEP 24576:pbgYk8nLak4UuWU9wrzq/B8BDz2b+umMp24JTi:jkibVrzq/B8BDq3rlJTi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

AgentTesla Payload 1 IoCs

resource	yara_rule
static1/unpack001/DHL_AWB #1008936572891_pdf.exe	family_agenttesla

Agenttesla family
agenttesla

MassLogger Main Payload 1 IoCs

resource	yara_rule
static1/unpack001/DHL_AWB #1008936572891_pdf.exe	family_masslogger

Masslogger family
masslogger

File Explorer

1ea26893b98115c9c36c6c1ecb7b4fa28b71ea8dc91f7219c7e54d9f95d4bf8e

.rar 809KB
DHL_AWB #1008936572891_pdf.exe

.exe 2.1MB

1ea26893b98115c9c36c6c1ecb7b4fa28b71ea8dc91f7219c7e54d9f95d4bf8e

SHA256 1ea26893b98115c9c36c6c1ecb7b4fa28b71ea8dc91f7219c7e54d9f95d4bf8e
MD5 cc5d1ba1b2cd9a126ce8cbc974e01f68
SHA1 f0819d43a4c6fab61ac49829a704db3e9193775f
SHA512 2b3220b2229f5cf20eb75c07c51cb3fb4bbaadebf7cb12507fc2c4fa0599833dc504146a0045565a8b7cb60793764f78d573a668c10faed350f1edc43b09bc58
SSDEEP 24576:pbgYk8nLak4UuWU9wrzq/B8BDz2b+umMp24JTi:jkibVrzq/B8BDq3rlJTi
MD5 SHA1 SHA512 SSDEEP

DHL_AWB #1008936572891_pdf.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 885179565290381c8e8e883f1e4c776507c1ddd3bfa8902f432ea31fbf01c683
MD5 3e910208a9f1bf03108895af8671078c
SHA1 6b59a64f11e6559c1354c8097856593469ecd8bc
SHA512 525ee64a0e0915fa5f35534187c230d3526395ebb42d7c0c68123b9804158d66d0078821c0e7f7a1bf7554322fa28a47d73a6422a7e451fd7dac3062b43dffeb
SSDEEP 49152:slekszEMhv32HMfjsMJxLQwe4mpLri4L:sPaEY2mth4
MD5 SHA1 SHA512 SSDEEP

windows x86

AgentTesla Payload
MassLogger Main Payload

Minor OS version

Major OS version

Entry point

2161310

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing