General
-
Target
64b254199fb625b9bcd537a3bf92708dd1564d5f563cb5ae527029a6d75764af
-
Size
682KB
-
Sample
220521-xg4tssbgb2
-
MD5
0f36d367b4c66909ce054750ac316847
-
SHA1
00200ba9b7a81ef9d3bb8f9525b2566d474be5de
-
SHA256
64b254199fb625b9bcd537a3bf92708dd1564d5f563cb5ae527029a6d75764af
-
SHA512
b07087485ae43c037014b286c2b337900ddb7a311c135e3aa0b311291d61eb77c8adf0f8f9b7e00c549f020b4d553abf168867e3f70eb4835168ddff70fd30cf
Static task
static1
Behavioral task
behavioral1
Sample
DHL AWB FILE.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DHL AWB FILE.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.gascuenca.es - Port:
587 - Username:
cesarrodriguez@gascuenca.es - Password:
gasW203@Z7
Extracted
Protocol: smtp- Host:
mail.gascuenca.es - Port:
587 - Username:
cesarrodriguez@gascuenca.es - Password:
gasW203@Z7
Targets
-
-
Target
DHL AWB FILE.exe
-
Size
1.1MB
-
MD5
ce3c13ed9f70019df2816b652bbac246
-
SHA1
d5fddf51d46036d347319dfdc23d37627ed2d499
-
SHA256
66e548774f497cb4dba29b195df59b74b351365eaa777f1516a1baa02805ab22
-
SHA512
dcf8e92995096fc8db154e73a2f985d2a201c8b43eb9612ba4edffffd103e752ba541027d1dced573bd4f4e456d4556bd03c3824eddd681cdb7f5583a9c2d28d
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-