General
- Target DHL_AWB# 9284730932 doc.exe
- Size 760KB
- Sample210510-rns71xtcb6
- SHA256 c3d7fef20e22a2a50e8762c39aa40caae7ec5a074ce39bb610f58ea2c6349f20
- MD5 1843c02b104d7f7e3eee33336f66b63e
- SHA1 dfb08da4cf37788f94c90b6ae8cf56fb3b744c1f
- SHA512 ed2ddbf8d9f31f8536a1a133143c518c8a99bfbec8b13f1ae9abf018f537e114b102b0e419c19bc5632e6c6c2469cc8b48c50eacda2943144b6689bff7baf429
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
DHL_AWB# 9284730932 doc.exe
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DHL_AWB# 9284730932 doc.exe
Resource
win10v20210410
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.esquiresweaters.com
-
Port
587
-
Username
-
Password
Esquire@#2078
Targets
-
- Target DHL_AWB# 9284730932 doc.exe
- Size 760KB
- SHA256 c3d7fef20e22a2a50e8762c39aa40caae7ec5a074ce39bb610f58ea2c6349f20
- MD5 1843c02b104d7f7e3eee33336f66b63e
- SHA1 dfb08da4cf37788f94c90b6ae8cf56fb3b744c1f
- SHA512 ed2ddbf8d9f31f8536a1a133143c518c8a99bfbec8b13f1ae9abf018f537e114b102b0e419c19bc5632e6c6c2469cc8b48c50eacda2943144b6689bff7baf429
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext