General
-
Target
de5174183d8e0a29d17e12126616a392bc38d150fd954c9e4a1ee20bf245245a
-
Size
602KB
-
Sample
220521-ny5yraech7
-
MD5
48c81f687a28b1c0c7077595496e2b62
-
SHA1
b610711ca626022661c015237661e33670ac8098
-
SHA256
de5174183d8e0a29d17e12126616a392bc38d150fd954c9e4a1ee20bf245245a
-
SHA512
a09b102869918a7bc3b0bd2f467b0626fc60ce462b8079fd8b222139dcfc79cb949a84a775f9ca65f182e2a31126cfaf790a7ff902f61a83b000dfca5f9da57f
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Details 00459010265 - 07.07.2020.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Shipping Details 00459010265 - 07.07.2020.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
sologlobal@yandex.com - Password:
amblessed22
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
sologlobal@yandex.com - Password:
amblessed22
Targets
-
-
Target
Shipping Details 00459010265 - 07.07.2020.exe
-
Size
719KB
-
MD5
ec25c93cf619cf346cbb955af0518baf
-
SHA1
6a72eb049453cc1aa268f424eb03fa4b466bcfea
-
SHA256
ad2da1fa0e285bd992c7dc1d0dcad3f5a476bd62478ebf958326302942fabeec
-
SHA512
52886dbab173286145b16e61a45051ca8a79bf94ed317e7f35047552c2ce47f51610f46e22b19b8dafa748f0c7c6974bbbd22e059ce28578810837540bb96df8
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-