General
- Target Shipment Import Invoice & Clearance Documents.xlsx.exe
- Size 966KB
- Sample230714-lml1dsda69
- SHA256 7a866c4ebda9c535d197ee8768fa8eafd71a54cee7f13556399aa8baaa059974
- MD5 44064b3d484d8606bcce4cb1512a3065
- SHA1 c98fa7127d74658708d898b093dc4222c31dc19e
- SHA512 f4b39b2410ce2f58c5837fdf642559834fdfbaa38aaac586ee977c1eb991744e1379b67f73464b02018dd86523eb1c9787c76d0b0260ef0b9d40f78179778984
- SSDEEP 24576:Vk70Trc+dJFRl/0ZmgPxBJMkCz7Wm9qPMh4OkdbfK:VkQTAUJbwMkiMUCfK
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
Shipment Import Invoice & Clearance Documents.xlsx.exe
Resource
win7-20230712-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
Shipment Import Invoice & Clearance Documents.xlsx.exe
Resource
win10v2004-20230703-en
3 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
webmail.gumustaslojistik.com
-
Port
587
-
Username
-
Password
?5sHR@5?
-
Email to
Targets
-
- Target Shipment Import Invoice & Clearance Documents.xlsx.exe
- Size 966KB
- SHA256 7a866c4ebda9c535d197ee8768fa8eafd71a54cee7f13556399aa8baaa059974
- MD5 44064b3d484d8606bcce4cb1512a3065
- SHA1 c98fa7127d74658708d898b093dc4222c31dc19e
- SHA512 f4b39b2410ce2f58c5837fdf642559834fdfbaa38aaac586ee977c1eb991744e1379b67f73464b02018dd86523eb1c9787c76d0b0260ef0b9d40f78179778984
- SSDEEP 24576:Vk70Trc+dJFRl/0ZmgPxBJMkCz7Wm9qPMh4OkdbfK:VkQTAUJbwMkiMUCfK
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext