Overview
overview
10Static
static
1c15539131...b2.exe
windows10-1703-x64
101c15539131...b2.exe
windows7-x64
101c15539131...b2.exe
windows10-2004-x64
10SecuriteIn...75.exe
windows10-1703-x64
10SecuriteIn...75.exe
windows7-x64
10SecuriteIn...75.exe
windows10-2004-x64
10FedEx EL18...00.exe
windows10-1703-x64
10FedEx EL18...00.exe
windows7-x64
10FedEx EL18...00.exe
windows10-2004-x64
10Static task
static1
Behavioral task
behavioral1
Sample
1c15539131a4b7a2864bf1cc5744ea213fce23e8b643d2cd00f0a242f4e775b2.exe
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
1c15539131a4b7a2864bf1cc5744ea213fce23e8b643d2cd00f0a242f4e775b2.exe
Resource
win7-20220901-en
Behavioral task
behavioral3
Sample
1c15539131a4b7a2864bf1cc5744ea213fce23e8b643d2cd00f0a242f4e775b2.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral4
Sample
SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe
Resource
win10-20220812-en
Behavioral task
behavioral5
Sample
SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
FedEx EL1870335D online Customer AWB Shipping Advisory AWB Docs.Commercial Invoice. Packing List. Bill of Landing CMS00.exe
Resource
win10-20220812-en
Behavioral task
behavioral8
Sample
FedEx EL1870335D online Customer AWB Shipping Advisory AWB Docs.Commercial Invoice. Packing List. Bill of Landing CMS00.exe
Resource
win7-20221111-en
Behavioral task
behavioral9
Sample
FedEx EL1870335D online Customer AWB Shipping Advisory AWB Docs.Commercial Invoice. Packing List. Bill of Landing CMS00.exe
Resource
win10v2004-20221111-en
General
-
Target
agent tesla.zip
-
Size
1.9MB
-
MD5
d225ddc20b5304abc03b618ac5608d9b
-
SHA1
686ab88af4a262d8f971cc718fbcc73ed83cf324
-
SHA256
4bd686e2d65fff7be39ba22a5170e2e1699659da1bb65cad0f642d825ef282b0
-
SHA512
d08b0027755e958beb2fdc0c54f3e7bcacbc6a569d7c7c1c450746baeed17a0bd0de0cd3a6997139b0fd9ca59f671c2e1d4792d7a9eb6eba936035b5aeecc7b8
-
SSDEEP
49152:j9g4rMuf3MF5GLY6hRx3xQof9jJRRYYgINfN2d62+1:Zg7u/GaYqxbVtPYYzV2d6f
Malware Config
Signatures
Files
-
agent tesla.zip.zip
Password: infected
-
__MACOSX/agent tesla/._.DS_Store
-
__MACOSX/agent tesla/._1c15539131a4b7a2864bf1cc5744ea213fce23e8b643d2cd00f0a242f4e775b2.zip
-
__MACOSX/agent tesla/._6f05a91cd30498cf1bc9b2e0058f1e3caa18b401b77d0a83b71a6df845430716.zip
-
__MACOSX/agent tesla/._a6339dda7fc718e5a77bb3736d1c87e6a8fbc14827525307b3e8f184f02afd48.zip
-
agent tesla/.DS_Store
-
agent tesla/1c15539131a4b7a2864bf1cc5744ea213fce23e8b643d2cd00f0a242f4e775b2.zip.zip
Password: infected
-
1c15539131a4b7a2864bf1cc5744ea213fce23e8b643d2cd00f0a242f4e775b2.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
agent tesla/6f05a91cd30498cf1bc9b2e0058f1e3caa18b401b77d0a83b71a6df845430716.zip.zip
Password: infected
-
SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe.exe windows x64
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 972B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
agent tesla/a6339dda7fc718e5a77bb3736d1c87e6a8fbc14827525307b3e8f184f02afd48.zip.zip
Password: infected
-
FedEx EL1870335D online Customer AWB Shipping Advisory AWB Docs.Commercial Invoice. Packing List. Bill of Landing CMS00.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 881KB - Virtual size: 880KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ