General
-
Target
DHL Shipping notification-PDF.exe
-
Size
668KB
-
Sample
240328-w92dpsdb8y
-
MD5
1af5b16224f32acdb6f6b6ec72f8bbe4
-
SHA1
4e8005f6484d1aa34e737cddf167a6d9f3a36ecc
-
SHA256
42507b45f4cc3ac0dd1bc6ba841fee90c67a8617a740b1f7a0725b55ce99c49d
-
SHA512
2b810a501905ce42aacc500f3d590d1db344490cf69904ba7527bd56351bc63b1563217ad48d6a35afae1fcd80cf42e1231a9af5565866e6d2526f8d469922dd
-
SSDEEP
12288:Ui0YOwqpKtIEWNKO/ZYcNYAVMZ70OPtCHme2oNGHKqoylx9:tO7p42WcJed7CHvlMqxQ
Static task
static1
Behavioral task
behavioral1
Sample
DHL Shipping notification-PDF.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
DHL Shipping notification-PDF.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp5ua.hyperhost.ua - Port:
587 - Username:
assadlog@oilandgascomp.xyz - Password:
7213575aceACE@# - Email To:
assad@oilandgascomp.xyz
Extracted
Protocol: smtp- Host:
cp5ua.hyperhost.ua - Port:
587 - Username:
assadlog@oilandgascomp.xyz - Password:
7213575aceACE@#
Targets
-
-
Target
DHL Shipping notification-PDF.exe
-
Size
668KB
-
MD5
1af5b16224f32acdb6f6b6ec72f8bbe4
-
SHA1
4e8005f6484d1aa34e737cddf167a6d9f3a36ecc
-
SHA256
42507b45f4cc3ac0dd1bc6ba841fee90c67a8617a740b1f7a0725b55ce99c49d
-
SHA512
2b810a501905ce42aacc500f3d590d1db344490cf69904ba7527bd56351bc63b1563217ad48d6a35afae1fcd80cf42e1231a9af5565866e6d2526f8d469922dd
-
SSDEEP
12288:Ui0YOwqpKtIEWNKO/ZYcNYAVMZ70OPtCHme2oNGHKqoylx9:tO7p42WcJed7CHvlMqxQ
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-