General
-
Target
24c4e3a4bb8ad00a99079c4ba1a810ae3ae30110ffb0450cdbf86546664fdf5f
-
Size
403KB
-
Sample
220521-pnh7nsfff7
-
MD5
61e7df573a57393877fd45742d13928e
-
SHA1
d1e88c53964d7bc61fa97e24605d0cbbd6ebbaaa
-
SHA256
24c4e3a4bb8ad00a99079c4ba1a810ae3ae30110ffb0450cdbf86546664fdf5f
-
SHA512
917a2fa74607b66d332692859d3a55159219e9162ebeb2d09e464f976695f7dc325261715bf33ff63c134ce16bf986c11832cd737aeb2093a0a5b3451eb8dab7
Static task
static1
Behavioral task
behavioral1
Sample
DHL-#AWB130501923096.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DHL-#AWB130501923096.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
petersonhouston@yandex.com - Password:
faith12AB
Targets
-
-
Target
DHL-#AWB130501923096.exe
-
Size
433KB
-
MD5
db42a352386ad14ebfb012ae58bd266d
-
SHA1
05926e8118ca4fbf55faf9b852e66720449c3842
-
SHA256
cd58b0bb08f218fdce3d57c001a8140b66661cdb7accb47a93ba2722ea64f0e9
-
SHA512
efc5dd4c911623bbd3553f42a8856dd4f173cb1e59f5ba0fbb12d17d10d55d4b9779ccca33a14bcec51a0dab5820c35633faf4b438fae76ad9db9ecbf55c038c
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-