cec862a0b1078b4483e0b54267ee9ceaacab47670053e4df5ff7fd97637becd9

General
Target

cec862a0b1078b4483e0b54267ee9ceaacab47670053e4df5ff7fd97637becd9

Size

412KB

Sample

220521-xkkv4abhf9

Score
10 /10
MD5

4e7075337bdb317ad3d05da97f0bafd2

SHA1

65d7f580c32447935eb165f5c5fc45956362e188

SHA256

cec862a0b1078b4483e0b54267ee9ceaacab47670053e4df5ff7fd97637becd9

SHA512

0fbca110d13950928850961cb8a10621f58fe1df8e16fda33143c645819523a83b3e253e48a6d5ad631378a44a3c47daa2e029d312a266132c041d75a83347eb

Malware Config

Extracted

Family agenttesla
Credentials

Protocol: smtp

Host: smtp.yandex.com

Port: 587

Username: petersonhouston@yandex.com

Password: faith12AB

Targets
Target

RF_DHL KULI500796821_PO200000035_SCAN DOCS.exe

MD5

8f178a002181e9b40cd09e244b61d1c9

Filesize

450KB

Score
10/10
SHA1

ea47dfa2d70ee217a9a5c4cf19c66c8a65108fc4

SHA256

bc3ad77264762f9b266ab641f391bbb456ef4bc5c27f64b884506eeaa84dfe58

SHA512

fa15075384a95e57c2077127fbccfc4eeed67d81cf140685c416858a7ca9bc5d310149d0952bf6fbdcfc0db65f7a53d1508edfadd490e69e1333137b5a327d15

Tags

Signatures

  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    Tags

  • AgentTesla Payload

  • Accesses Microsoft Outlook profiles

    Tags

    TTPs

    Email Collection
  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
Command and Control
    Credential Access
      Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation