General
-
Target
0a34f49aeaf4f551c0a2cc3f82cf5febb111dfbf20760f936d6cda15d47762b5
-
Size
359KB
-
Sample
220521-ncrh8sgehl
-
MD5
5d8a3b227f46c7c818a1a6d2ad8353a9
-
SHA1
84f46f42e21249dfe248fb68773887d90bca070c
-
SHA256
0a34f49aeaf4f551c0a2cc3f82cf5febb111dfbf20760f936d6cda15d47762b5
-
SHA512
3df4b3ef52bb0c6e41907017cc93653561c0cb081c94c8f209cb61bbe4da0409915469aaea3ebad134160acbc255eb5a03bdef258dda7877e62d4d1f7bcf02e7
Static task
static1
Behavioral task
behavioral1
Sample
dhl_doc7348255141.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
dhl_doc7348255141.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.waltartosto.com - Port:
587 - Username:
e.fasciani@waltartosto.com - Password:
pZQhjl!9
Targets
-
-
Target
dhl_doc7348255141.exe
-
Size
422KB
-
MD5
20e9fed94db568a0528021b9b86e146a
-
SHA1
f1c5e739ba485e28fec47e11bd7ca9e3817d4b8b
-
SHA256
aedee4f131eef738b19991d52758a3e5aa8b804a6763a9fd48b568f1351d5452
-
SHA512
f403e12abd5cf17b7881ca440f149a236c94b91e25fe77f06844b829d72dc82c5e023c8e4a023edfb9b084ddd3fdc087ef55cc863989d8a92ac67966cbad5b0f
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-