General
-
Target
cec862a0b1078b4483e0b54267ee9ceaacab47670053e4df5ff7fd97637becd9
-
Size
412KB
-
Sample
220521-xkkv4abhf9
-
MD5
4e7075337bdb317ad3d05da97f0bafd2
-
SHA1
65d7f580c32447935eb165f5c5fc45956362e188
-
SHA256
cec862a0b1078b4483e0b54267ee9ceaacab47670053e4df5ff7fd97637becd9
-
SHA512
0fbca110d13950928850961cb8a10621f58fe1df8e16fda33143c645819523a83b3e253e48a6d5ad631378a44a3c47daa2e029d312a266132c041d75a83347eb
Static task
static1
Behavioral task
behavioral1
Sample
RF_DHL KULI500796821_PO200000035_SCAN DOCS.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
RF_DHL KULI500796821_PO200000035_SCAN DOCS.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
petersonhouston@yandex.com - Password:
faith12AB
Targets
-
-
Target
RF_DHL KULI500796821_PO200000035_SCAN DOCS.exe
-
Size
450KB
-
MD5
8f178a002181e9b40cd09e244b61d1c9
-
SHA1
ea47dfa2d70ee217a9a5c4cf19c66c8a65108fc4
-
SHA256
bc3ad77264762f9b266ab641f391bbb456ef4bc5c27f64b884506eeaa84dfe58
-
SHA512
fa15075384a95e57c2077127fbccfc4eeed67d81cf140685c416858a7ca9bc5d310149d0952bf6fbdcfc0db65f7a53d1508edfadd490e69e1333137b5a327d15
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-